Behavioral Drift-Aware Adaptive Anomaly Fusion for Explainable Risk Monitoring in Salary Advance FinTech Systems

Abstract

Digital salary advance and earned wage access platforms require intelligent monitoring mechanisms capable of identifying behavioral anomalies, estimating operational risk, and preserving auditable transaction evidence. Existing financial anomaly detection approaches commonly rely on isolated predictive models, static anomaly thresholds, or rule-based monitoring, providing limited support for behavior-aware enterprise monitoring. This study proposes a behavioral drift-aware adaptive anomaly fusion framework for explainable risk monitoring in salary advance FinTech systems. The framework introduces the Behavioral Risk Deviation Index (BRDI), which integrates temporal irregularity, behavioral entropy, transaction velocity, burst activity, and historical behavioral drift into a unified behavioral state representation. BRDI adaptively regulates the fusion of Isolation Forest-based statistical anomaly scores and reconstruction-based nonlinear anomaly scores according to each employee’s behavioral profile. The framework further combines calibrated ensemble risk scoring, SHAP-based explainability, and blockchain-assisted audit verification using SHA-256 hashing and Merkle-root validation. Experimental evaluation on 52,846 anonymized salary advance transactions demonstrates that the framework supports behavior-aware anomaly detection, interpretable risk prioritization, and trustworthy audit traceability in enterprise financial environments. The proposed approach contributes a unified behavioral state representation, a deterministic adaptive anomaly fusion mechanism, and an integrated architecture for trustworthy AI-assisted salary advance monitoring.

1. Introduction

The rapid expansion of digital financial ecosystems has transformed the structure, delivery, and risk profile of modern financial services. FinTech platforms increasingly rely on artificial intelligence, automated decision-making, cloud infrastructures, and real-time transaction processing to improve financial accessibility, operational efficiency, and customer interaction. Among these services, salary advance and earned wage access platforms have become increasingly relevant because they allow employees to access earned income before the regular payroll date. Such platforms can improve short-term financial liquidity and reduce dependence on informal lending mechanisms; however, they also introduce new operational risks related to transaction irregularities, repeated advance requests, abnormal user behavior, fraud attempts, and audit transparency.

Salary advance FinTech systems differ from conventional payment or credit platforms because their risk structure is closely connected to payroll cycles, employee income patterns, employer-side verification, repayment conditions, and repeated short-term transaction behavior. In this environment, suspicious activities may not always appear as large-value fraudulent transactions but instead may emerge through behavioral deviations, unusual timing, repeated micro-withdrawals, abnormal transaction frequency, burst activity, or inconsistencies between historical user behavior and current transaction patterns. However, not all behavioral changes necessarily indicate fraudulent activity, since employee transaction behavior may also evolve because of payroll schedules, seasonal financial needs, or broader organizational and socio-economic factors. Consequently, the proposed framework interprets behavioral deviations as operational monitoring signals requiring further assessment rather than as direct evidence of fraudulent intent. Therefore, effective monitoring requires behavioral state modeling, adaptive anomaly detection, explainable risk assessment, and reliable audit verification.

Recent developments in financial technologies have increased the complexity of operational risk in modern FinTech ecosystems, requiring adaptive AI-driven monitoring capable of detecting evolving transaction behaviors beyond static rule-based approaches [1]. These challenges are particularly important in salary advance environments, where anomalous behavior is often rare and context-dependent.

Artificial intelligence is increasingly used for fraud detection, credit risk assessment, regulatory monitoring, and financial decision support [2]. However, recent studies also emphasize growing concerns regarding transparency, fairness, governance, regulatory compliance, and financial stability [3,4,5]. Consequently, future FinTech systems require monitoring architectures that combine adaptive analytics with explainability, auditability, and operational accountability.

Despite substantial progress in AI-driven financial analytics, most existing studies focus on isolated fraud detection models, standalone anomaly detection algorithms, or blockchain-based integrity mechanisms. Few provide an integrated monitoring architecture that combines behavioral profiling, adaptive anomaly detection, explainable risk assessment, and audit-oriented verification. Moreover, enterprise financial monitoring requires immutable audit evidence to ensure traceability and regulatory accountability, which conventional centralized logging mechanisms cannot always guarantee.

To address these limitations, this study proposes a Behavioral Drift-Aware Adaptive Anomaly Fusion framework for explainable risk monitoring in salary advance FinTech systems. The framework introduces the Behavioral Risk Deviation Index (BRDI), which integrates behavioral entropy, temporal irregularity, transaction velocity, burst activity, and historical behavioral drift into a unified behavioral state representation that regulates adaptive anomaly fusion, thereby enabling anomaly estimation to adapt to evolving employee behavior rather than relying on static behavioral representations or fixed fusion strategies.

Statistical and reconstruction-based anomaly detectors are adaptively combined through the proposed Adaptive Behavioral Anomaly Fusion (ABAF) mechanism. The framework further integrates calibrated ensemble risk scoring, SHAP-based explainability, blockchain-assisted audit verification using SHA-256 hashing and Merkle-root validation, and a cryptographic governance mechanism for behavioral baseline versioning. In addition, supervisory population-level drift monitoring enables automatic behavioral baseline recalibration when organization-wide behavioral shifts are detected, thereby preserving both adaptive monitoring capability and audit traceability under evolving operational conditions.

The proposed framework was evaluated using 52,846 anonymized salary advance transaction records collected from an enterprise financial environment. The results demonstrate the ability of the proposed framework to support behavior-aware anomaly monitoring, interpretable operational risk prioritization, and audit-oriented transaction traceability.

The main contributions of this study are summarized as follows:

• A unified Behavioral Risk Deviation Index (BRDI) serving as a behavioral state representation that integrates behavioral entropy, transaction velocity, burst activity, temporal irregularity, and behavioral drift to regulate adaptive anomaly fusion;
• A deterministic behavioral drift estimation mechanism that quantifies deviations between current and historical employee behavior for adaptive transaction monitoring;
• An Adaptive Behavioral Anomaly Fusion approach that dynamically combines statistical anomaly detection and reconstruction-based behavioral anomaly analysis according to employee-specific behavioral states represented by the BRDI;
• An explainable risk monitoring framework integrating calibrated ensemble learning, SHAP-based interpretation, and probability calibration for transparent operational risk assessment;
• A blockchain-assisted governance mechanism supporting tamper-resistant transaction traceability, behavioral baseline versioning, cryptographic governance of baseline recalibration, and operational accountability in enterprise financial environments.
• A supervisory monitoring extension that detects population-level behavioral drift, distinguishes organization-wide behavioral shifts from localized employee anomalies, and initiates cryptographically governed behavioral baseline recalibration without introducing feedback into the predictive models.

The remainder of this paper is organized as follows. Section 2 reviews related work on financial anomaly detection, behavioral analytics, explainable AI, behavioral drift modeling, and blockchain-assisted auditability. Section 3 presents the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion approach, including the Behavioral Risk Deviation Index, behavioral drift modeling, adaptive anomaly fusion mechanism, explainable risk scoring, and blockchain-assisted audit verification components. Section 4 describes the dataset, experimental environment, evaluation methodology, anomaly detection results, explainability analysis, stress-testing under population-level behavioral drift, cryptographic governance of behavioral baseline recalibration, and blockchain-assisted audit verification. Section 5 discusses the main findings, practical implications, limitations, and future research directions. Finally, Section 6 concludes the paper.

2. Related Work

This section reviews prior research from the perspective of the operational challenges encountered in salary advance monitoring. Rather than comparing algorithms in isolation, the review identifies the limitations of existing approaches with respect to behavioral monitoring, explainability, auditability, and adaptive risk assessment required in earned wage access systems.

2.1. AI-Based Financial Fraud Detection

Artificial intelligence and machine learning have become central components of modern financial fraud detection because they enable the identification of hidden transactional patterns, adaptive fraud behaviors, and operational anomalies in large-scale financial environments. Recent research increasingly explores deep learning, ensemble learning, behavioral transaction analytics, and explainable AI to improve both detection accuracy and operational transparency.

Prashanth et al. [6] investigated bank transaction fraud detection using TabNet with SMOTE-based balancing and comparative evaluation against deep neural architectures, demonstrating strong predictive performance and improved explainability through sparse feature selection. Sai and Mohan [7] reviewed machine learning applications in financial analytics and emphasized the growing importance of explainable and ethical AI for trustworthy financial system design. However, these studies primarily focus on predictive performance rather than integrating behavioral anomaly profiling, calibration, and audit-oriented verification.

Recent studies have further explored adaptive fraud detection architectures capable of modeling evolving transaction dynamics. Aktarujjaman et al. [8] combined bidirectional LSTM networks with attention mechanisms for financial crime detection, whereas Kolli et al. [9] employed federated learning and spiking neural networks for decentralized payment environments. Hybrid approaches have also been proposed, including the clustering-ensemble framework with SHAP explainability introduced by Almusallam and Qayyum [10], the Temporal-Attention Isolation Forest with Dynamic Calibration developed by Huang et al. [11], and the adaptive fuzzy fraud detection model presented by Charizanos et al. [12]. Together, these studies demonstrate the growing importance of adaptive monitoring under evolving transaction conditions.

Graph-oriented and attention-based learning approaches further improve fraud detection by modeling complex transactional relationships. Oliveira et al. [13] integrated graph neural networks, clustering, and community detection for intelligent financial monitoring, while Mao et al. [14] demonstrated the effectiveness of graph neural representations for higher-order transaction modeling. Transformer-based anomaly detection was investigated by Xiu [15], whereas Wang et al. [16] combined convolutional neural networks with Transformer self-attention for blockchain transaction anomaly detection. In addition, Mirza et al. [17] comparatively evaluated multiple anomaly detection techniques using synthetic and real-world financial datasets, confirming the effectiveness of intelligent analytical methods for identifying irregular transaction patterns and operational risks.

Overall, recent studies demonstrate substantial progress in AI-based financial fraud detection through deep learning, graph-oriented analytics, adaptive anomaly detection, and real-time monitoring. Nevertheless, most existing approaches prioritize predictive performance and investigate behavioral modeling, explainability, or auditability as separate research directions rather than as components of a unified enterprise monitoring architecture. This gap motivates the Behavioral Drift-Aware Adaptive Anomaly Fusion framework proposed in this study.

2.2. Behavioral Analytics in Financial Systems

Behavioral analytics has become an important component of intelligent financial monitoring because it enables the identification of hidden operational risks, anomalous user activities, and evolving behavioral patterns beyond conventional transaction-level analysis. Recent advances in artificial intelligence have expanded its application to digital payment systems and enterprise FinTech infrastructures through behavioral profiling, temporal activity modeling, and adaptive anomaly detection.

Recent studies demonstrate the value of behavioral analytics for operational risk management in financial environments. Strang [18] applied semi-supervised machine learning to large-scale employee behavioral data and showed that interaction patterns can reveal operational vulnerabilities and cybercrime-related risks. Khalil et al. [19] investigated AI-driven automation for letter-of-credit document examination, demonstrating improvements in discrepancy detection, operational efficiency, and compliance verification. In digital lending, Zhou et al. [20] showed that emotional signals extracted from social media interactions improve default probability estimation and repayment intervention strategies, highlighting the growing importance of non-traditional behavioral indicators in financial analytics.

Adaptive learning has further strengthened behavioral monitoring under dynamically changing transaction conditions. Kong [21] proposed a neural-network-based framework integrating dynamic feature extraction, data fusion, and abnormal transaction discovery, demonstrating improved identification of anomalous behavioral patterns compared with conventional rule-based monitoring.

Overall, behavioral analytics is playing an increasingly important role in intelligent financial monitoring and operational risk assessment. Nevertheless, existing studies primarily investigate behavioral modeling, document intelligence, emotional analytics, or adaptive learning as separate research directions. Few provide an integrated enterprise monitoring architecture that combines behavioral state representation, adaptive anomaly fusion, explainable risk assessment, and audit-oriented verification for salary advance monitoring. This gap motivates the framework proposed in this study.

2.3. Explainable Risk Analytics for FinTech

Explainable risk analytics has become an essential component of modern FinTech systems as artificial intelligence increasingly supports fraud detection, credit scoring, operational monitoring, and financial decision-making. Consequently, recent research emphasizes that AI-driven financial systems must provide not only high predictive performance but also transparency, fairness, interpretability, and regulatory accountability.

Recent studies demonstrate that hybrid machine learning architectures can improve financial risk assessment while supporting explainable decision-making. Farag et al. [22] proposed a hybrid machine learning–econometric framework based on ensemble models for financial distress assessment, whereas Yongchareon [23] emphasized the importance of risk-aware evaluation beyond predictive accuracy in long-term stock market forecasting. Antonius [24] further introduced a governance-oriented FinTech ecosystem integrating temporal deep learning, SHAP-based explainability, fairness correction, and ethical AI mechanisms. Although these approaches strengthen explainability and governance, they primarily address forecasting and financial prediction rather than transaction-level anomaly monitoring.

Explainability techniques such as SHAP and LIME are increasingly employed to improve transparency and stakeholder trust in financial AI systems. Sailer [25] reviewed explainable AI applications across finance, while Chowdhury et al. [26] demonstrated the value of governance-oriented hybrid models supported by SHAP-based interpretation. At the same time, trustworthy AI research highlights the need for transparency, accountability, fairness, robustness, and regulatory compliance throughout the AI lifecycle [27,28,29]. These studies establish the importance of explainability but rarely integrate it with adaptive behavioral monitoring and enterprise auditability.

Blockchain-assisted explainability has recently emerged as a complementary approach for improving decision traceability. Parlak [30] proposed Blockchain-Assisted Explainable Decision Traces (BAXDT), combining SHAP-based explanations with immutable blockchain records to strengthen transparency and auditability. Recent work on intelligent credit scoring and financial risk assessment further demonstrates the effectiveness of explainable ensemble learning. Tigges et al. [31] discussed transparency and fairness challenges in AI-driven credit scoring, while Geng et al. [32] and Yu et al. [33] combined ensemble learning with SHAP-based interpretation for interpretable financial risk prediction.

Overall, recent studies demonstrate substantial progress in explainable risk analytics through interpretable ensemble learning, trustworthy AI, and blockchain-assisted decision traceability. Nevertheless, most existing approaches explain the outputs of predictive models rather than adaptive monitoring architectures. Explainable risk assessment, behavioral state modeling, adaptive anomaly fusion, and audit-oriented verification remain largely investigated as separate research directions instead of being integrated into a unified enterprise monitoring framework. This gap motivates the Behavioral Drift-Aware Adaptive Anomaly Fusion framework proposed in this study.

2.4. Blockchain-Assisted Auditability and Financial Integrity

Blockchain technologies are increasingly recognized as effective mechanisms for improving transparency, integrity, security, and auditability in modern financial systems. The growing complexity of digital financial ecosystems has intensified the need for immutable transaction traceability, cryptographic verification, and trustworthy operational monitoring capable of supporting regulatory compliance and financial integrity.

Recent studies demonstrate that blockchain infrastructures substantially strengthen secure financial operations. Hasan et al. [34] proposed a quantum-resistant blockchain protocol for secure smart contracts in cross-border financial systems, while Tran Tien et al. [35] reviewed blockchain-assisted financial anomaly detection and highlighted the benefits of combining distributed ledger technologies with intelligent analytics for transparent financial monitoring.

Blockchain technologies have also been widely investigated as mechanisms for improving auditability and operational integrity. Daah et al. [36] integrated Zero Trust architecture, hybrid access control, and blockchain-assisted immutable transaction logging for financial networks, whereas Ariciu et al. [37] reviewed blockchain adoption in accounting and auditing, emphasizing its role in fraud monitoring, digital accountability, and regulatory compliance. Studies by Chiu et al. [38] and Liao et al. [39] further demonstrated that blockchain adoption improves financial reporting quality, accounting reliability, and operational transparency.

The integration of blockchain with artificial intelligence has recently emerged as an important direction for trustworthy financial monitoring. Qader and Cek [40] and Han et al. [41] demonstrated that combining blockchain with AI improves fraud detection, governance, transparency, continuous auditing, and financial reporting reliability. In parallel, blockchain-assisted integrity verification has been strengthened through cryptographic validation and Merkle Hash Tree mechanisms for verifying consistency between on-chain and off-chain financial data [42]. Guo et al. [43] additionally demonstrated that blockchain-enabled smart contracts can automate suspicious transaction monitoring and support near real-time auditing.

Overall, recent studies demonstrate substantial progress in blockchain-assisted financial integrity through immutable transaction logging, cryptographic verification, smart contract automation, and AI-assisted auditing. Nevertheless, most existing approaches either employ blockchain technologies to ensure transaction integrity or apply AI for financial risk analysis without integrating these capabilities into a unified enterprise monitoring architecture. Behavioral state modeling, adaptive anomaly fusion, explainable risk assessment, and blockchain-assisted audit verification therefore remain largely disconnected research directions. This gap motivates the Behavioral Drift-Aware Adaptive Anomaly Fusion framework proposed in this study.

2.5. Problem Statement, Research Gap, and Objectives

Salary advance (also referred to as Earned Wage Access, EWA) systems have become an increasingly important component of digital financial services, enabling employees to access a portion of their already earned wages before the scheduled payroll date without issuing a new consumer loan. Unlike conventional consumer lending, EWA does not involve the origination of new debt but rather the controlled early disbursement of earned income based on payroll information.

Monitoring salary advance platforms presents several challenges that differ from traditional financial fraud detection. Transaction behavior is strongly influenced by payroll cycles, salary adjustments, seasonal bonuses, working schedules, employment status, and individual liquidity needs. Consequently, abrupt changes in transaction frequency or withdrawal timing do not necessarily indicate fraudulent activity, while genuinely suspicious behavior may emerge through subtle deviations from an employee’s historical behavioral profile. This creates a difficult operational problem in which monitoring systems must distinguish potentially risky behavioral deviations from legitimate changes in financial behavior while maintaining low false-positive rates. Accordingly, the objective of the proposed framework is not to infer the underlying causes of behavioral change but to identify employee-specific behavioral deviations that require further operational assessment. Unlike supervised fraud detection systems, the proposed framework does not seek to estimate the probability of confirmed fraudulent behavior or compliance violations. Instead, it focuses on identifying statistically and behaviorally unusual transaction patterns that require additional operational attention. This distinction reflects the practical characteristics of enterprise salary advance monitoring, where the enterprise dataset used in this study does not contain externally verified fraud labels or compliance adjudications and operational decision-making relies on expert assessment following automated behavioral prioritization.

From an operational perspective, inaccurate monitoring has direct economic consequences. Excessive false-positive alerts increase the workload of compliance and financial officers, delay legitimate salary advance approvals, and reduce user trust, whereas missed anomalous transactions may lead to financial losses, policy violations, payroll inconsistencies, or abuse of earned wage access services. Therefore, salary advance providers require monitoring systems capable of identifying genuinely suspicious behavioral deviations while minimizing unnecessary manual investigations.

Existing monitoring approaches are typically designed either for conventional credit scoring, where the objective is to estimate the probability of future default, or for payment-card fraud detection, where fraudulent transactions are identified based on transaction-level abnormalities. In contrast, salary advance monitoring is a continuous operational surveillance task within an already approved payroll ecosystem. Its objective is not to determine whether credit should be granted, but to identify abnormal transaction behavior that may indicate policy violations, abnormal operational behavior, or suspicious usage patterns. Moreover, salary advance monitoring must distinguish suspicious behavioral deviations from legitimate behavioral changes caused by payroll schedules, employment conditions, salary adjustments, and seasonal financial needs. Consequently, salary advance monitoring requires dedicated analytical methods rather than the direct application of conventional credit-scoring or fraud-detection models.

The reviewed literature demonstrates substantial progress in AI-driven financial fraud detection, behavioral analytics, explainable AI, and blockchain-assisted financial integrity. Recent studies increasingly emphasize adaptive machine learning, interpretable decision support, governance-aware AI, and trustworthy financial infrastructures [25,44,45,46]. Nevertheless, these research directions remain largely fragmented. Existing approaches typically address predictive modeling, explainability, behavioral analytics, or blockchain-assisted auditability independently, providing limited integration within unified enterprise monitoring architectures capable of supporting adaptive behavioral monitoring, explainable risk assessment, and operational audit verification.

Overall, existing research demonstrates the growing need for financial intelligence systems capable of combining explainable AI, adaptive anomaly detection, behavioral transaction analytics, probabilistic calibration, and trustworthy auditability mechanisms within unified operational architectures. However, an important limitation remains insufficiently addressed in the existing literature: the ability to explicitly model behavioral drift and dynamically adapt anomaly detection mechanisms to evolving transaction behavior.

Most existing financial anomaly detection approaches rely on static behavioral representations or fixed anomaly fusion strategies. Although behavioral features, temporal indicators, and anomaly scores are frequently incorporated into machine learning pipelines, the majority of existing studies do not explicitly quantify deviations between current transaction behavior and historical behavioral profiles. As a result, anomaly detection performance may gradually deteriorate when transaction patterns evolve over time due to changing payroll cycles, user financial conditions, seasonal effects, or operational workflow modifications.

Furthermore, existing hybrid anomaly detection approaches typically combine multiple anomaly signals using predefined or fixed weighting schemes. Such strategies assume that the relative importance of statistical outliers and behavioral irregularities remains constant across all transactions. In practice, however, financial anomalies may emerge through different mechanisms and exhibit varying behavioral characteristics. Consequently, anomaly fusion mechanisms should adapt to the behavioral risk state associated with each transaction rather than rely on static fusion rules.

To address both the practical operational challenges of salary advance monitoring and the research gaps identified above, this study proposes a Behavioral Drift-Aware Adaptive Anomaly Fusion approach for explainable operational anomaly monitoring in salary advance FinTech systems. The proposed approach introduces a Behavioral Risk Deviation Index (BRDI), a unified behavioral state representation that integrates behavioral entropy, transaction velocity, burst activity, temporal irregularity, and behavioral drift. Rather than serving as an independent predictive feature, BRDI functions as an adaptive control variable that dynamically regulates the contribution of statistical and reconstruction-based anomaly detectors according to each employee’s behavioral state.

Unlike supervised financial fraud detection, the proposed framework does not assume the availability of externally verified fraud labels or compliance violation outcomes. Instead, it identifies salary advance transactions whose behavioral characteristics deviate substantially from an employee’s historical profile and therefore require additional operational assessment. Consequently, the anomaly score represents a behavioral monitoring priority rather than evidence of fraudulent activity or an estimate of future misconduct. Behavioral deviations may arise from legitimate organizational, seasonal, payroll-related, or socio-economic factors; therefore, final operational assessment remains under human responsibility.

2.5.1. Research Aim

Accordingly, the aim of this study is to develop, implement, and experimentally evaluate an explainable behavioral drift-aware anomaly monitoring framework for salary advance FinTech systems. Rather than predicting confirmed fraud events, the proposed framework aims to identify and prioritize statistically and behaviorally unusual salary advance transactions that warrant additional operational assessment while preserving interpretability, auditability, and robustness under evolving transaction conditions. The framework is therefore designed as an unsupervised operational monitoring architecture and does not require externally verified fraud labels for model training.

2.5.2. Research Questions

To achieve the above objective, the study addresses the following research questions:

• RQ1: How can employee-specific behavioral drift be represented to support adaptive anomaly monitoring in salary advance systems?
• RQ2: Does adaptive behavioral anomaly fusion provide measurable improvements over conventional fixed-weight anomaly fusion strategies?
• RQ3: Can explainable behavioral anomaly assessment and cryptographic audit verification be integrated into a unified operational monitoring framework without compromising anomaly detection performance?

3. Proposed ABAF Framework

3.1. Overall System Architecture

This study proposes an explainable AI and blockchain-assisted framework for behavioral risk scoring, adaptive anomaly detection, and operational auditability in salary advance FinTech systems. The proposed architecture integrates behavioral transaction analytics, unsupervised anomaly detection, supervised risk scoring, explainable machine learning, and blockchain-assisted integrity verification within a unified enterprise financial monitoring environment.

The framework consists of six operational layers supported by three core analytical components: Behavioral Drift Modeling, the Behavioral Risk Deviation Index (BRDI), and Adaptive Behavioral Anomaly Fusion (ABAF). Together, these components provide end-to-end transaction monitoring, adaptive anomaly detection, explainable risk assessment, and tamper-resistant auditability under evolving behavioral conditions.

Figure 1 illustrates the overall architecture of the proposed framework.

Figure 1. Overall architecture of the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion (ABAF) framework integrating BRDI-based behavioral risk modeling, explainable risk scoring, and blockchain-assisted audit verification.

The Data Acquisition and Integration Layer collects operational financial data from salary advance platforms, payroll systems, transaction processing infrastructures, user activity logs, and enterprise financial environments. The collected information includes transaction records, payment histories, timestamps, account activity indicators, user interaction logs, and operational workflow metadata. The architecture supports heterogeneous financial environments through standardized data ingestion and unified transaction representation mechanisms.

The Data Processing and Feature Engineering Layer performs preprocessing, normalization, missing-value handling, categorical transformation, and behavioral feature extraction. This layer additionally generates analytical indicators such as transaction frequency, off-hours activity ratios, temporal activity distributions, rolling transaction statistics, behavioral entropy metrics, velocity indicators, and burst activity characteristics. These engineered features provide structured behavioral and operational representations for downstream anomaly detection and risk scoring tasks.

The Behavioral State Modeling Layer constructs historical behavioral profiles and quantifies deviations between current and historical transaction behavior using temporal activity patterns, transaction regularity indicators, and behavioral change measurements. These descriptors are integrated into the Behavioral Risk Deviation Index (BRDI), which combines behavioral drift, entropy, transaction velocity, burst activity, and temporal irregularity into a unified behavioral state representation. Rather than serving as an independent predictive feature, BRDI functions as an adaptive control variable regulating the proposed ABAF mechanism, enabling the framework to capture evolving behavioral instability beyond isolated transaction-level indicators.

The Behavioral Anomaly Detection and Fusion Layer integrates Isolation Forest [47] anomaly detection with reconstruction-based anomaly analysis to identify both statistical outliers and nonlinear behavioral anomalies within transaction streams. The outputs of these complementary anomaly detection mechanisms are subsequently combined using the proposed Adaptive Behavioral Anomaly Fusion (ABAF) mechanism. ABAF dynamically adjusts anomaly estimation according to the behavioral state represented by BRDI, thereby improving robustness under evolving behavioral patterns. Adaptive weighting reflects deviations of individual employees relative to their own historical profiles and is intended to prioritize behavioral monitoring rather than infer fraudulent intent or distinguish organizational and socio-economic causes of behavioral change.

The Explainable Risk Scoring Layer performs supervised operational risk estimation using ensemble machine learning models. The explainability layer is applied to the calibrated ensemble classifier, whereas BRDI and ABAF operate in the upstream anomaly monitoring stage. Consequently, feature attribution reflects the supervised risk-scoring model rather than the adaptive fusion mechanism itself. The framework integrates Gradient Boosting [48], Random Forest [49], and Extra Trees [50] classifiers to generate calibrated transaction-level risk scores representing the probability of suspicious operational behavior. To improve interpretability and operational transparency, the system incorporates feature importance analysis, SHAP-based explainability [51], and probability calibration mechanisms. These components improve the reliability and interpretability of generated risk estimates in enterprise monitoring environments.

The Blockchain-Assisted Audit Verification Layer provides tamper-resistant transaction traceability using SHA-256 hashing and Merkle-root aggregation rather than a fully decentralized blockchain. Cryptographic integrity verification preserves immutable evidence of transaction states and analytical outputs while maintaining scalability suitable for enterprise financial infrastructures.

The proposed architecture operates through a sequential yet interconnected operational workflow. Financial transactions are first collected and normalized within the preprocessing environment. Behavioral state and anomaly detection procedures are subsequently applied to identify suspicious operational activity and behavioral irregularities. The extracted anomaly indicators and engineered behavioral features are then processed within the explainable ensemble learning module to estimate transaction-level financial risk. Finally, the generated analytical outputs, transaction states, and integrity verification hashes are recorded within the blockchain-assisted audit layer to support operational transparency and tamper-resistant auditability.

Unlike existing financial monitoring systems that separately address fraud detection, explainability, auditability, or fixed anomaly fusion, the proposed architecture integrates these capabilities within a unified enterprise monitoring framework. Its principal contribution lies not in the individual anomaly detection algorithms but in the BRDI-driven adaptive fusion mechanism and its integration with explainable risk assessment, probability calibration, and blockchain-assisted integrity verification for salary advance monitoring.

3.2. Data Processing and Feature Engineering Layer

The Data Processing and Feature Engineering Layer transforms heterogeneous financial transaction data into structured analytical representations suitable for behavioral state modeling, anomaly detection, explainable risk scoring, and operational monitoring. Since salary advance transaction data are often noisy, incomplete, imbalanced, and temporally irregular, robust preprocessing and feature engineering are essential for reliable downstream analysis.

The proposed framework processes operational data collected from salary advance platforms, payroll systems, user interaction logs, and enterprise financial records. These data include salary advance request timestamps, transaction amounts, payroll payment status, employee operational metadata, account activity indicators, and historical salary advance transaction patterns. Prior to analysis, all personally identifiable information was anonymized to satisfy financial data protection and confidentiality requirements.

Since the enterprise dataset did not contain externally verified fraud labels or confirmed compliance violations, the monitoring task is formulated as behavioral anomaly detection rather than supervised fraud classification. Accordingly, anomalies represent behaviorally unusual salary advance transactions relative to an employee’s historical behavioral profile and are interpreted as operational monitoring signals requiring further automated assessment and, where appropriate, expert review rather than evidence of fraudulent activity. The complementary statistical and reconstruction-based anomaly detection mechanisms used for anomaly identification are described in Section 3.4.

The preprocessing stage includes data cleaning, missing-value imputation, categorical encoding, normalization, outlier treatment, and temporal synchronization. Missing numerical values were handled using statistical imputation, categorical variables were transformed into machine-learning-compatible representations, and continuous variables were normalized to improve model stability. Records exhibiting severe inconsistencies or corrupted operational states were excluded from further analysis.

Temporal synchronization organizes transaction activities into rolling observation windows that preserve the sequential nature of employee behavior. Historical behavioral profiles are continuously updated within these windows, enabling adaptive behavioral state estimation while maintaining consistency with each employee’s long-term transaction history.

Unlike generic financial fraud detection, feature engineering is specifically designed for salary advance environments. Behavioral representations are derived from employee-specific salary advance histories, operational transaction patterns, temporal characteristics, and recurring earned wage access activities. Consequently, behavioral states are defined relative to each employee’s historical transaction behavior rather than to the overall transaction population.

The engineered feature space consists of six categories:

• Transaction frequency features;
• Temporal behavioral features;
• Statistical transaction features;
• Behavioral entropy indicators;
• Velocity and burst activity features;
• Historical transaction profile features.

Transaction frequency features characterize operational activity intensity through transaction counts, rolling frequencies, repetition patterns, and average occurrence rates. Temporal behavioral features describe activity distributions across time using off-hours ratios, weekday distributions, transaction interval variability, and timing irregularities. Statistical transaction features include rolling averages, rolling standard deviations, cumulative statistics, transaction amount volatility, and other aggregated indicators computed over adaptive observation windows.

Behavioral entropy indicators quantify the irregularity and unpredictability of transaction behavior by measuring behavioral randomness, activity dispersion, and sequence diversity. Velocity and burst activity features identify rapid increases in transaction intensity and concentrated activity within short time intervals, whereas historical transaction profile features summarize employee-specific salary advance histories to distinguish recurring behavioral patterns from emerging anomalies.

To improve analytical robustness, highly correlated and redundant variables were evaluated during feature preparation. The resulting feature space balances predictive informativeness, behavioral interpretability, and computational scalability while limiting unnecessary feature redundancy.

The engineered features are subsequently utilized by the Behavioral State Modeling Layer, the Adaptive Behavioral Anomaly Fusion Layer, and the Explainable Risk Scoring Layer. By combining statistical, temporal, and behavioral representations, the proposed feature engineering process provides the information required for BRDI computation, adaptive anomaly fusion, and explainable operational risk assessment.

3.3. Behavioral State Modeling

The Behavioral State Modeling Layer constructs employee-specific behavioral state representations and identifies deviations from historically observed salary advance behavior within enterprise FinTech environments. Unlike conventional transaction monitoring systems that rely on isolated financial indicators or static rule-based thresholds, the proposed framework models behavioral dynamics by capturing temporal dependencies, operational regularity, activity concentration, and evolving transaction characteristics.

Behavioral state modeling is particularly important because suspicious activities do not always manifest through extreme transaction amounts or explicit fraud indicators. Instead, anomalies frequently emerge through irregular activity timing, burst transaction sequences, unexpected transaction frequencies, behavioral drift, or deviations from historical behavioral patterns. Such deviations are interpreted as operational monitoring signals requiring further assessment rather than evidence of fraudulent intent.

Employee-specific behavioral states are constructed from temporally aggregated transaction activities and operational interaction patterns. Each employee is represented by a multidimensional behavioral profile comprising statistical, temporal, sequential, and entropy-based descriptors generated during feature engineering. These representations characterize both short-term behavioral fluctuations and long-term transaction regularity.

Behavioral baselines are established by analyzing transaction frequency consistency, temporal activity distributions, transaction interval stability, and behavioral repetition patterns. Temporal modeling further evaluates hourly activity, weekday distributions, and rolling observation windows to identify off-hours transactions, abnormal activity concentrations, and unexpected behavioral bursts.

The framework additionally incorporates behavioral drift analysis to quantify gradual or abrupt deviations between current transaction behavior and historical behavioral baselines. Behavioral drift forms one component of the Behavioral Risk Deviation Index (BRDI), where it contributes to the unified behavioral state representation used by the Adaptive Behavioral Anomaly Fusion mechanism. This enables the framework to adapt to continuously evolving employee behavior while preserving consistency with long-term behavioral profiles.

Entropy-based behavioral descriptors further quantify transaction irregularity and behavioral unpredictability by measuring activity dispersion, sequence randomness, and transaction diversity. Elevated entropy values may indicate unstable behavioral patterns, whereas highly repetitive transaction structures may suggest automated or coordinated activity. These entropy-based descriptors complement conventional statistical indicators by improving sensitivity to subtle behavioral anomalies.

The resulting behavioral summaries combine transaction consistency, temporal activity signatures, burst activity characteristics, entropy measures, and behavioral drift into a unified behavioral representation. These representations provide the behavioral context required for downstream BRDI computation, Adaptive Behavioral Anomaly Fusion, and explainable operational risk assessment.

3.3.1. Behavioral Drift Modeling

Financial transaction behavior evolves over time due to changes in payroll schedules, employee financial conditions, organizational policies, seasonal effects, and operational workflows. Consequently, anomaly detection models based solely on static behavioral representations may gradually lose sensitivity to emerging abnormal patterns. To address this limitation, the proposed framework introduces a Behavioral Drift Modeling mechanism that quantifies deviations between the current employee-specific behavioral state and the corresponding historical behavioral profile.

The objective of behavioral drift modeling is to estimate the extent to which recent transaction activity differs from previously observed behavioral patterns. Unlike conventional anomaly detection approaches that evaluate transactions independently, the proposed method explicitly models the temporal evolution of employee behavior by continuously updating historical behavioral baselines.

For each monitored employee, a current behavioral profile is represented as

$$P_t=[f_t,e_t,v_t,b_t,s_t]$$

(1)

where $f_t$ represents transaction frequency indicators, $e_t$ denotes behavioral entropy measures, $v_t$ corresponds to transaction velocity features, $b_t$ represents burst activity characteristics, and $s_t$ contains aggregated statistical transaction descriptors.

The corresponding historical behavioral baseline is defined as

$${\overline{P}}_t=[{\overline{f}}_t,{\overline{e}}_t,{\overline{v}}_t,{\overline{b}}_t,{\overline{s}}_t]$$

(2)

and is estimated using rolling historical observations collected over previous operational periods.

Behavioral drift is quantified as the normalized Euclidean distance between the current and historical behavioral profiles:

$$D_t={\displaystyle \frac{\parallel P_t-{\overline{P}}_t{\parallel }_2}{{\parallel {\overline{P}}_t\parallel }_2+\epsilon }}$$

(3)

where ${\parallel ·\parallel }_2$ denotes the Euclidean norm and $\epsilon$ is a small constant introduced to ensure numerical stability. All behavioral profile components are normalized to the interval $[0, 1]$ prior to drift estimation, ensuring comparability across employees with different transaction activity levels while reducing sensitivity to feature magnitude.

The Euclidean distance was selected because the objective is to quantify the overall magnitude of behavioral deviation rather than directional similarity or covariance structure. Since all behavioral descriptors are normalized, this metric provides a consistent, interpretable, and computationally efficient measure of cumulative behavioral change suitable for continuous enterprise monitoring.

Higher values of $D_t$ indicate stronger deviations from historical behavioral patterns, whereas lower values indicate behavioral consistency. To improve robustness against short-term fluctuations, behavioral drift is smoothed using an exponential moving average:

$${\widehat{D}}_t=\beta D_t+(1-\beta ){\widehat{D}}_{t-1}$$

(4)

where $\beta$ is the smoothing coefficient controlling the influence of recent observations.

The resulting drift estimate represents behavioral change relative to each employee’s own historical profile rather than to the overall transaction population. Consequently, it provides an interpretable measure of evolving behavioral dynamics that serves as one component of the Behavioral Risk Deviation Index (BRDI). Behavioral drift is interpreted as an operational monitoring signal requiring further assessment rather than as direct evidence of fraudulent intent. By incorporating this descriptor into BRDI, the proposed framework adapts anomaly sensitivity to evolving transaction behavior while preserving interpretability and compatibility with the downstream Adaptive Behavioral Anomaly Fusion mechanism.

3.3.2. Behavioral Risk Deviation Index (BRDI)

Individual behavioral indicators provide useful information about transaction activity but often fail to characterize the overall behavioral state of a monitored employee. Financial anomalies may emerge through combinations of temporal irregularities, abnormal transaction intensity, behavioral instability, and evolving activity patterns rather than through a single behavioral feature. To address this limitation, the proposed framework introduces the Behavioral Risk Deviation Index (BRDI), which integrates complementary behavioral descriptors into a unified behavioral state representation.

Unlike conventional risk indicators that rely primarily on transaction-level attributes or anomaly scores, BRDI combines information obtained from temporal activity analysis, entropy-based profiling, transaction dynamics, and behavioral drift modeling. The proposed index consists of five complementary behavioral components:

• Behavioral entropy score (E);
• Transaction velocity score (V);
• Burst activity score (B);
• Temporal irregularity score (T);
• Smoothed behavioral drift score ($\widehat{D}$).

Each component is computed independently and normalized to the interval $[0, 1]$ prior to aggregation, ensuring comparability across different behavioral dimensions. Specifically,

• E denotes the normalized behavioral entropy computed from salary advance transaction activity;
• V denotes the normalized transaction velocity measured over the observation window;
• B denotes the normalized burst activity score representing short-term concentrations of salary advance requests;
• T denotes the normalized temporal irregularity score describing deviations from expected salary advance transaction timing;
• $\widehat{D}$ denotes the normalized smoothed behavioral drift score computed according to Equation (4).

The Behavioral Risk Deviation Index is computed as

$$BRDI=w_{1}E+w_{2}V+w_{3}B+w_{4}T+w_5\widehat{D}$$

(5)

where $w_1,w_2,w_3,w_4,$ and $w_5$ denote weighting coefficients satisfying

$${\displaystyle \sum _{i=1}^5}{w}_i=1$$

(6)

and reflecting the relative contribution of each behavioral component to the overall behavioral state.

The novelty of BRDI does not lie in the weighted linear aggregation itself, which was intentionally selected to preserve transparency and interpretability. Rather, its contribution is the unified behavioral state representation that integrates entropy, transaction velocity, burst activity, temporal irregularity, and behavioral drift into a single adaptive descriptor used to regulate anomaly fusion.

In this study, equal weights were assigned to all BRDI components ($w_1=w_2=w_3=w_4=w_5=0.2$). Equal weighting preserves interpretability, provides balanced representation of all behavioral dimensions, and avoids introducing additional optimization bias into the behavioral state representation.

Higher BRDI values indicate stronger behavioral deviations from historical transaction patterns, whereas lower values indicate behavioral consistency. Consequently, BRDI provides a compact and interpretable representation of behavioral instability that supports downstream anomaly monitoring.

Unlike conventional behavioral indicators that are directly used as predictive variables, BRDI functions as an adaptive control variable regulating the relative contribution of statistical and reconstruction-based anomaly detectors within the Adaptive Behavioral Anomaly Fusion (ABAF) mechanism. It therefore serves as a behavioral state representation rather than an independent behavioral risk predictor, enabling behavior-aware anomaly fusion while preserving interpretability.

3.4. Behavioral Anomaly Detection and Fusion Layer

The Behavioral Anomaly Detection and Fusion Layer identifies behaviorally unusual salary advance transactions, hidden operational irregularities, and evolving behavioral anomalies within enterprise FinTech environments. Because anomalous financial behavior is often heterogeneous, sparse, nonlinear, and dynamically evolving, the proposed framework combines two complementary unsupervised approaches: (i) Isolation Forest-based anomaly detection and (ii) reconstruction-based behavioral anomaly analysis. Their integration enables simultaneous detection of statistical transaction outliers and nonlinear behavioral irregularities that cannot be reliably captured by either method alone.

The first anomaly detection component is based on the Isolation Forest algorithm, which is particularly effective for identifying sparse anomalous observations in high-dimensional financial datasets. Isolation Forest operates by recursively partitioning the feature space using randomly generated decision boundaries. Since anomalous observations typically exhibit distinct behavioral characteristics and lower occurrence frequency, they are isolated through fewer partitioning operations compared with normal operational transactions.

The Isolation Forest module processes engineered behavioral and statistical transaction features generated during the preprocessing stage, including transaction frequency indicators, temporal activity distributions, entropy-based behavioral metrics, burst activity features, and rolling transaction statistics. The algorithm generates anomaly scores representing the relative isolation characteristics of transaction behaviors within the multidimensional feature space.

The anomaly score generated by the Isolation Forest component is defined as

$$S_{IF}\left(x\right)=2^{-{\displaystyle \frac{E\left(h\right(x\left)\right)}{c\left(n\right)}}}$$

(7)

where $E\left(h\right(x\left)\right)$ represents the expected path length required to isolate transaction x, and $c\left(n\right)$ denotes the average path length normalization factor for a dataset containing n observations. Lower expected isolation depth corresponds to a higher anomaly likelihood.

Although statistical outlier detection provides strong robustness for identifying sparse abnormal transaction behaviors, many financial anomalies additionally involve nonlinear operational dependencies and hidden behavioral irregularities that cannot be fully captured using partition-based anomaly estimation alone. Consequently, the proposed framework further integrates a reconstruction-based anomaly detection mechanism designed to model nonlinear behavioral representations and reconstruction-based operational irregularities.

The reconstruction component is implemented as an unsupervised neural reconstruction model [52] trained to compress and reconstruct normal transaction behavior patterns. The model learns latent behavioral representations describing normal operational transaction structures within the multidimensional feature space. During inference, anomalous transaction behaviors typically generate larger reconstruction errors because their operational characteristics deviate from the learned behavioral representations associated with normal financial activities.

The reconstruction error generated by the neural reconstruction module is computed as

$$S_R\left(x\right)={\parallel x-\widehat{x}\parallel }^2$$

(8)

where x denotes the original transaction feature vector, while $\widehat{x}$ represents the reconstructed feature vector generated by the neural reconstruction model. Higher reconstruction error values indicate stronger behavioral irregularity and a greater likelihood of anomalous behavior.

Before adaptive anomaly fusion, the outputs of the Isolation Forest and reconstruction-based anomaly detectors are transformed into comparable anomaly representations using detector-specific thresholding and normalization procedures. Because the two detectors produce anomaly scores with different numerical ranges and opposite score directions, their outputs are first standardized using empirical score distributions estimated from the training data. This preprocessing ensures that both anomaly scores represent comparable levels of anomaly severity before adaptive behavioral weighting is applied.

The proposed framework combines the outputs of the Isolation Forest and neural reconstruction modules through an Adaptive Behavioral Anomaly Fusion (ABAF) mechanism designed to dynamically adjust anomaly estimation according to the current behavioral risk state of each transaction. Unlike conventional hybrid anomaly detection approaches that employ fixed weighting schemes, the proposed method utilizes the Behavioral Risk Deviation Index (BRDI) introduced in Equation (5) to regulate the contribution of statistical and behavioral anomaly indicators.

The proposed framework is designed to quantify localized behavioral deviations occurring at the level of individual employees or relatively small organizational groups operating under relatively stable organizational conditions. Accordingly, BRDI is intended to characterize employee-specific behavioral changes rather than organization-wide behavioral shifts. If simultaneous increases in BRDI are observed across a substantial proportion of the monitored population, such behavior may indicate that the operational assumption of localized behavioral drift has been violated due to external factors, such as macroeconomic shocks, organizational restructuring, payroll policy modifications, or other population-level events. Under these circumstances, elevated BRDI values should not be interpreted as increased employee-level organizational risk. Instead, they represent an organization-level operational signal requiring administrative assessment and possible recalibration of behavioral baselines before employee-level risk prioritization resumes.

Different types of behavioral anomalies exhibit different characteristics. Sparse statistical outliers are effectively detected by Isolation Forest, whereas gradual behavioral drift, nonlinear dependencies, and evolving transaction patterns are more effectively captured by reconstruction-based analysis. Consequently, the relative contribution of each detector should adapt to the behavioral state represented by BRDI rather than remain fixed across all transactions.

To achieve this objective, the framework computes an adaptive fusion coefficient based on the estimated behavioral risk level:

$$\alpha \left(x\right)={\displaystyle \frac{BRDI\left(x\right)}{1+BRDI\left(x\right)}}$$

(9)

where $BRDI\left(x\right)$ denotes the Behavioral Risk Deviation Index associated with transaction x. Higher BRDI values indicate stronger behavioral instability and consequently increase the influence of reconstruction-based behavioral anomaly analysis.

Unlike optimization-based adaptive fusion methods, the proposed weighting mechanism is fully deterministic. For each transaction, the fusion coefficient is computed directly from the corresponding BRDI value using Equation (9). Since BRDI is derived from explicitly defined behavioral descriptors, every adaptive state transition can be analytically traced to measurable behavioral changes rather than to hidden learned parameters. Consequently, the adaptive fusion process remains inherently transparent and fully auditable independently of the downstream SHAP-based explanation of the final ensemble prediction.

The final adaptive anomaly score is computed as

$$A\left(x\right)=\alpha \left(x\right)S_R\left(x\right)+\left(1-\alpha \left(x\right)\right)S_{IF}\left(x\right)$$

(10)

where $S_R\left(x\right)$ represents the reconstruction-based anomaly score and $S_{IF}\left(x\right)$ denotes the Isolation Forest anomaly score.

The adaptive fusion operates on calibrated anomaly scores rather than raw detector outputs, ensuring that adaptive weighting reflects behavioral state information encoded by BRDI instead of numerical differences between detector score distributions. This prevents either detector from dominating the fusion process solely because of score magnitude.

Consequently, the proposed fusion mechanism dynamically balances statistical outlier detection and reconstruction-based behavioral analysis according to the estimated behavioral state. Compared with fixed-weight fusion strategies, this improves robustness to behavioral drift and evolving transaction patterns while maintaining an interpretable relationship between behavioral state estimation and anomaly assessment.

To improve operational interpretability, the anomaly detection layer records transaction-level behavioral explanations derived from feature contributions, reconstruction errors, temporal deviations, and entropy-based descriptors. Because BRDI regulates anomaly fusion through a deterministic weighting function, the behavioral state associated with each transaction remains fully traceable and available for downstream explanation and audit.

The outputs of the anomaly detection layer include Behavioral Risk Deviation Index values, behavioral drift indicators, adaptive anomaly scores, statistical outlier scores, reconstruction error metrics, anomaly probabilities, and adaptive anomaly severity estimates. These analytical outputs are transmitted to downstream explainable ensemble learning modules responsible for calibrated financial risk scoring and intelligent operational monitoring.

Overall, the proposed Behavioral Anomaly Detection and Fusion Layer provides a scalable and behavior-aware anomaly monitoring mechanism for enterprise salary advance systems. By integrating statistical outlier detection, nonlinear behavioral reconstruction, BRDI-driven adaptive fusion, and deterministic behavioral state regulation, the framework supports interpretable and robust anomaly prioritization under evolving operational conditions.

3.5. Explainable Risk Scoring Layer

The Explainable Risk Scoring Layer estimates transaction-level operational risk and generates calibrated, interpretable risk assessments for behaviorally unusual salary advance transactions. Unlike conventional black-box prediction systems that primarily optimize predictive accuracy, the proposed framework integrates ensemble learning, probability calibration, and explainable AI to support transparent, trustworthy, and audit-oriented financial decision-making.

The proposed framework integrates an ensemble learning strategy combining multiple supervised machine learning models to improve prediction robustness, operational stability, and analytical generalization under heterogeneous financial conditions. The ensemble architecture incorporates the following machine learning models:

• Gradient Boosting classifier;
• Random Forest classifier;
• Extra Trees classifier.

These models were selected due to their strong performance in structured financial datasets, robustness against nonlinear feature interactions, adaptability to heterogeneous behavioral patterns, and suitability for explainable financial analytics.

Gradient Boosting, Random Forest, and Extra Trees were selected because they provide complementary predictive characteristics for structured financial data. Gradient Boosting captures complex nonlinear relationships through sequential residual optimization, Random Forest improves robustness through bootstrap aggregation and random feature selection, whereas Extra Trees increases ensemble diversity through randomized split generation. Together, these models improve prediction stability and generalization under heterogeneous behavioral conditions.

The outputs of the individual ensemble models are aggregated to generate a unified operational risk score representing the probability of suspicious financial activity. The ensemble risk estimation function is defined as

$$R\left(x\right)={\displaystyle \frac{1}{M}}{\displaystyle \sum _{i=1}^M}{P}_i\left(x\right)$$

(11)

where $P_i\left(x\right)$ represents the predicted probability generated by ensemble model i, and M denotes the total number of ensemble models participating in the risk estimation process. Unlike conventional risk estimation approaches relying primarily on transaction-level attributes, the proposed ensemble integrates statistical transaction features, temporal activity descriptors, adaptive anomaly scores generated by ABAF, and behavioral context represented through BRDI. This combination enables simultaneous assessment of statistical irregularities, behavioral deviations, and anomaly severity during downstream risk estimation.

Unlike conventional risk estimation approaches relying primarily on transaction-level attributes, the proposed ensemble integrates statistical transaction features, temporal activity descriptors, adaptive anomaly scores generated by ABAF, and behavioral context represented through BRDI. This combination enables simultaneous assessment of statistical irregularities, behavioral deviations, and anomaly severity during downstream risk estimation.

The calibrated probability estimation function is represented as

$$P_{cal}\left(x\right)=f_{cal}\left(P_{raw}\left(x\right)\right)$$

(12)

where $P_{raw}\left(x\right)$ represents the raw ensemble prediction probability, while $f_{cal}$ denotes the probability calibration function used to improve predictive reliability and probabilistic consistency.

Calibration improves the consistency and interpretability of generated risk probabilities, making them more suitable for operational prioritization, audit procedures, and financial decision support.

The explainability component evaluates the contribution of transaction-level predictors used by the downstream ensemble classifier, including statistical transaction descriptors, temporal activity indicators, and adaptive anomaly scores. Behavioral state information encoded by BRDI influences these explanations indirectly through the behavior-aware anomaly scores generated by the ABAF mechanism rather than through direct feature attribution.

The proposed framework combines feature importance analysis with SHAP-based explainability to identify the dominant factors contributing to elevated operational risk.

The SHAP-based contribution estimation for feature i is represented as

$${\varphi }_i=\sum _{S\subseteq F\setminus \left\{i\right\}}{\displaystyle \frac{\left|S\right|!\left(\right|F|-|S|-1)!}{\left|F\right|!}}\left[f(S\cup \{i\left\}\right)-f\left(S\right)\right]$$

(13)

where ${\varphi }_i$ denotes the Shapley contribution associated with feature i, F represents the complete feature set, and $f\left(S\right)$ denotes the model prediction generated using feature subset S. The weighting term reflects the contribution of feature i across all possible feature subset combinations. Because the adaptive fusion weights are deterministic functions of BRDI, the behavioral state associated with each analyzed transaction remains reproducible during subsequent audit and compliance review even when the relative contribution of the anomaly detectors varies across transactions.

The generated explainability outputs support operational transparency, regulatory accountability, audit-oriented analysis, and trustworthy financial decision-making. By transforming complex ensemble predictions into interpretable analytical insights, the framework improves stakeholder trust and supports explainable operational monitoring within enterprise-oriented financial environments.

Outputs include calibrated transaction risk probabilities, feature contribution explanations, behavioral importance rankings, operational risk categories, and associated behavioral context required for downstream blockchain-assisted audit verification.

Overall, the Explainable Risk Scoring Layer provides calibrated, interpretable, and auditable operational risk estimates that complement the behavior-aware anomaly detection process. By integrating ensemble learning, probability calibration, and explainable AI, the framework supports transparent financial decision-making and trustworthy enterprise salary advance monitoring.

3.6. Blockchain-Assisted Audit Verification Layer

The Blockchain-Assisted Audit Verification Layer provides tamper-resistant transaction traceability, operational accountability, and cryptographic integrity verification within the proposed salary advance monitoring framework. Unlike conventional centralized logging systems, which may be vulnerable to unauthorized modification and incomplete audit trails, the proposed architecture preserves cryptographically verifiable records of analytical outputs and operational decisions to support trustworthy enterprise financial monitoring.

The audit layer operates independently of the analytical intelligence modules while continuously receiving transaction identifiers, adaptive anomaly scores, calibrated risk estimates, explainability outputs, behavioral state information, and operational metadata. This architectural separation preserves scalable AI-driven analytics while maintaining independent and tamper-evident audit verification.

The proposed framework utilizes lightweight blockchain-inspired integrity verification based on SHA-256 hashing and Merkle-tree aggregation rather than a fully decentralized distributed ledger. Unlike consensus-based blockchain platforms, this design prioritizes enterprise deployment, computational efficiency, and auditability while preserving tamper-evident verification of analytical outputs and transaction histories. Each monitored transaction is transformed into a cryptographically protected audit record containing transaction metadata, analytical outputs, behavioral anomaly indicators, and operational verification attributes.

For each transaction record, a cryptographic transaction hash is generated as

$$H_i=\mathrm{Hash}(T_i\Vert R_i\Vert A_i\Vert t_i)$$

(14)

where $H_i$ represents the cryptographic integrity hash generated for transaction i, $T_i$ denotes transaction-related information, $R_i$ corresponds to the calibrated behavioral risk score, $A_i$ represents anomaly assessment outputs, $t_i$ denotes timestamp metadata, and ‖ indicates concatenation of the associated transactional and analytical components.

The transaction hashes are recursively aggregated into a Merkle tree [53], producing a single root hash representing the integrity state of the monitored transaction block. Any unauthorized modification of transactional or analytical records changes the corresponding Merkle root, enabling efficient integrity verification while avoiding the computational overhead associated with distributed consensus protocols.

The Merkle root for a set of transaction hashes is recursively computed as

$$M_{root}=\mathrm{Hash}(H_{left}\Vert H_{right})$$

(15)

where $M_{root}$ represents the parent Merkle hash generated from two child transaction hashes, while $H_{left}$ and $H_{right}$ denote the left and right child cryptographic hashes within the Merkle verification structure.

The recursive aggregation process continues until a single root verification hash representing the integrity state of the monitored transaction block is generated. Any unauthorized modification of transactional data, analytical outputs, or operational records results in inconsistency within the Merkle verification structure, thereby enabling immediate integrity violation detection.

The proposed audit verification mechanism supports several important operational functions:

• Tamper-evident transaction traceability;
• Audit-oriented integrity verification;
• Tamper-resistant operational monitoring;
• Explainable analytical trace preservation;
• Regulatory and compliance support.

Tamper-evident transaction traceability enables reconstruction of the complete analytical lifecycle of each monitored transaction, including behavioral state information, anomaly detection outputs, calibrated risk scores, and explainability summaries. Because cryptographic audit records preserve both adaptive anomaly scores and their associated behavioral context, operational decisions remain reproducible during subsequent audit and compliance review.

The framework additionally maintains timestamp synchronization and sequential verification to preserve chronological consistency across operational events and prevent retrospective modification of transaction histories.

The Blockchain-Assisted Audit Verification Layer also supports operational interoperability with external auditing systems, enterprise governance infrastructures, and regulatory reporting mechanisms. The generated verification records and integrity hashes can be exported to external compliance environments to support independent financial auditing, operational investigations, and governance-oriented reporting procedures.

The outputs generated by the audit verification layer include cryptographic transaction hashes, Merkle-root integrity states, immutable audit logs, explainability trace references, and integrity validation reports. These outputs collectively support trustworthy financial monitoring, transparent operational analytics, and audit-oriented transaction verification within enterprise salary advance environments.

Overall, the Blockchain-Assisted Audit Verification Layer complements the analytical components of the proposed framework by providing lightweight cryptographic integrity verification, tamper-evident transaction traceability, and reproducible audit records. By combining SHA-256 hashing with Merkle-tree aggregation, the framework supports trustworthy enterprise salary advance monitoring while preserving computational efficiency, operational transparency, and auditability.

3.7. Operational Workflow

The proposed hybrid Blockchain–AI framework operates through a sequential yet interconnected operational workflow integrating behavioral state modeling, adaptive anomaly fusion, explainable risk scoring, and blockchain-assisted audit verification for enterprise salary advance monitoring.

Figure 2 illustrates the operational workflow of the proposed framework.

Figure 2. Operational workflow of the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion (ABAF) framework for explainable anomaly detection, calibrated risk scoring, and blockchain-assisted audit verification in salary advance FinTech systems.

The workflow begins with the continuous acquisition of operational financial data from salary advance platforms, payroll infrastructures, transaction processing systems, and enterprise financial environments. Incoming transaction records include payment amounts, timestamps, employee identifiers, operational metadata, transaction histories, and user interaction information. These heterogeneous data streams are transferred to the preprocessing environment through standardized ingestion pipelines and unified transaction representation procedures.

During the preprocessing stage, the framework performs data cleaning, normalization, missing-value handling, categorical transformation, and temporal synchronization operations. The cleaned transaction data are subsequently processed through the feature engineering pipeline, where behavioral indicators, statistical transaction metrics, temporal activity features, rolling operational statistics, entropy-based behavioral indicators, and burst activity characteristics are generated. These engineered features provide structured analytical representations required for downstream intelligent financial monitoring.

The engineered features are processed by the Behavioral State Modeling Layer, where employee-specific behavioral profiles and historical baselines are constructed for subsequent behavioral drift estimation.

Following behavioral state modeling, behavioral drift is estimated by comparing current transaction behavior with historical behavioral baselines. The resulting drift score is subsequently incorporated into the Behavioral Risk Deviation Index (BRDI).

The computed behavioral drift indicators are subsequently integrated into the Behavioral Risk Deviation Index (BRDI), which provides a unified behavioral state representation for regulating the subsequent Adaptive Behavioral Anomaly Fusion (ABAF) mechanism.

The behavioral representations and BRDI values are subsequently processed by the Behavioral Anomaly Detection and Fusion Layer, where Isolation Forest and reconstruction-based anomaly detection are performed. Their outputs are then adaptively fused by the proposed ABAF mechanism using BRDI-dependent weighting to generate transaction-level adaptive anomaly scores.

Adaptive anomaly scores together with behavioral and statistical features are processed by the Explainable Risk Scoring Layer, where the ensemble classifier estimates calibrated transaction-level risk probabilities and generates SHAP-based explanations supporting transparent operational decision making.

To improve operational transparency and trustworthy financial analytics, explainability mechanisms are simultaneously applied during the risk estimation stage. SHAP-based feature contribution analysis and feature importance evaluation procedures identify the dominant behavioral and transactional factors contributing to elevated operational risk estimation. Behavioral state information encoded by BRDI influences these explanations indirectly through the adaptive anomaly scores generated by the ABAF mechanism. The explainability outputs enable financial analysts and monitoring systems to interpret anomaly severity and understand the analytical reasoning underlying AI-generated financial risk assessments.

The resulting analytical outputs are forwarded to the Blockchain-Assisted Audit Verification Layer, where SHA-256 hashing and Merkle-tree aggregation generate tamper-evident audit records supporting transaction traceability and integrity verification.

The blockchain-assisted audit layer preserves analytical traces and operational verification artefacts, enabling auditors and governance systems to reconstruct the analytical lifecycle of monitored transactions. Because both adaptive anomaly scores and behavioral state information are retained within the audit records, the rationale underlying each monitoring decision remains reproducible during audit and compliance review.

The proposed workflow further supports interoperability with external enterprise systems, regulatory infrastructures, compliance monitoring environments, and operational dashboards. Generated analytical outputs and verification records can be exported to external financial governance systems for reporting, auditing, operational investigation, and regulatory review purposes.

Overall, the proposed operational workflow integrates behavioral state modeling, adaptive anomaly fusion, explainable risk scoring, probability calibration, and blockchain-assisted audit verification into a unified enterprise monitoring pipeline supporting transparent, behavior-aware, and auditable salary advance monitoring.

4. Experimental Setup and Results

4.1. Dataset Description

The experimental evaluation was conducted using a real-world anonymized financial transaction dataset obtained from an operational salary advance and enterprise financial processing environment. The dataset contains historical transaction records associated with salary advance requests, payroll-related financial operations, employee transaction activities, and operational financial workflows collected from enterprise-oriented FinTech infrastructures.

The final dataset contained 52,846 operational transaction records, including 2417 anomalous transactions. The dataset covered the period from April 2024 to March 2026 and reflected real enterprise salary advance transaction activity under practical financial monitoring conditions. The reported anomalies correspond to behaviorally unusual salary advance transactions identified through the enterprise operational monitoring process and subsequent analytical review. They should therefore be interpreted as operational anomaly labels rather than confirmed cases of fraud or financial misconduct.

For model development and evaluation, the dataset was partitioned chronologically into training and testing subsets while preserving the original anomaly proportion as closely as possible. Earlier transaction periods were used for model development, whereas later periods were reserved for independent evaluation. In addition, stratified five-fold cross-validation was performed during model evaluation to assess the robustness and stability of the proposed framework. Mean performance values were calculated across the cross-validation folds.

To ensure confidentiality, privacy protection, and compliance with financial data governance requirements, all personally identifiable information and sensitive operational attributes were fully anonymized prior to analytical processing. Direct identifiers including employee names, account numbers, personal identifiers, and organization-specific metadata were removed or transformed into irreversible anonymized representations. This study therefore focuses exclusively on behavioral transaction analytics and operational anomaly monitoring without exposing sensitive financial information.

The dataset includes multiple categories of operational financial information, including transaction amounts, transaction timestamps, employee-related operational identifiers, transaction status indicators, temporal activity characteristics, behavioral interaction metadata, and historical transaction patterns. These attributes were subsequently utilized during preprocessing, behavioral state modeling, adaptive anomaly detection, and explainable risk scoring procedures within the proposed hybrid Blockchain–AI framework.

The preprocessing stage included missing-value handling, normalization, categorical encoding, temporal synchronization, and outlier management procedures. In addition, behavioral and statistical feature engineering mechanisms were applied to generate operational transaction indicators including rolling transaction statistics, temporal activity features, entropy-based behavioral metrics, burst activity indicators, and transaction regularity representations. Features directly or indirectly associated with target-related anomaly aggregation were subsequently removed during the leakage prevention procedure described in Section 4.3.

To preserve temporal consistency and reduce information leakage risks, transaction records were processed according to operational chronological ordering during experimental preparation. This strategy improves the realism of the evaluation environment and better reflects practical enterprise-oriented financial monitoring conditions.

Figure 3 presents the temporal distribution of anomalous operational financial activities and anomaly rate dynamics observed within the experimental dataset.

Figure 3. Monthly distribution of anomalous salary advance transactions and anomaly rate dynamics within the anonymized enterprise dataset.

Figure 4 illustrates the behavioral distribution of transaction amounts across normal and anomalous operational financial activities.

Figure 4. Distribution of salary advance transaction amounts for normal and anomalous operational activities in the anonymized enterprise dataset.

Figure 5 presents the correlation structure of engineered behavioral and financial transaction features utilized within the proposed framework. The variables shown in Figure 5 represent the initial exploratory feature space prior to leakage analysis. Leakage-sensitive variables identified during the validation procedure were removed before construction of the final analytical feature set used for all reported experimental results.

Figure 5. Correlation heatmap of the initially engineered behavioral and financial transaction features used during the preliminary exploratory analysis before construction of the final leak-free feature set.

Overall, the dataset provides a realistic enterprise salary advance monitoring environment for evaluating behavioral state modeling, adaptive anomaly fusion, explainable operational risk assessment, and cryptographically verifiable audit mechanisms under naturally imbalanced transaction conditions.

4.2. Experimental Environment

The experimental evaluation of the proposed hybrid Blockchain–AI framework was conducted in a Python 3.11-based analytical environment integrating machine learning, anomaly detection, explainable artificial intelligence, cryptographic verification, and data visualization components. The environment was designed to support scalable financial transaction analysis, behavioral state modeling, ensemble risk scoring, and blockchain-assisted audit verification under enterprise-oriented operational conditions.

Data preprocessing, feature engineering, statistical analysis, and temporal transaction aggregation were implemented using Python with Pandas and NumPy. Visualization of transaction behavior, anomaly distributions, feature correlations, calibration results, and explainability outputs was performed using Matplotlib and Seaborn.

The AI-based anomaly detection and risk scoring components were implemented using Scikit-learn-based machine learning pipelines. The anomaly detection layer incorporated Isolation Forest for statistical outlier detection and a neural reconstruction mechanism for identifying nonlinear behavioral irregularities. The detector outputs were subsequently normalized using detector-specific calibration procedures before adaptive anomaly fusion, ensuring that both anomaly scores represented comparable levels of anomaly severity.

The explainable risk scoring layer integrated three supervised ensemble learning models: Gradient Boosting, Random Forest, and Extra Trees classifiers. These models were trained using engineered behavioral transaction indicators, anomaly detection outputs, temporal activity characteristics, and operational financial metadata generated during preprocessing and behavioral state. Probability calibration procedures were applied to improve the reliability and interpretability of transaction-level risk scores in operational monitoring settings. The calibration procedures were applied only to the supervised ensemble risk-scoring models and were not used to calibrate the unsupervised anomaly detectors.

Explainable artificial intelligence mechanisms were implemented using SHAP-based feature contribution analysis and feature importance estimation. These procedures enabled transaction-level interpretation of behavioral indicators, anomaly severity factors, and risk estimation outputs. The blockchain-assisted audit verification component was implemented using lightweight cryptographic hashing and Merkle-tree-based integrity validation mechanisms. The audit layer generated transaction hashes, Merkle-root verification records, and integrity validation outputs for anomaly monitoring results, explainability summaries, and calibrated risk scores.

The dataset was partitioned into independent training and testing subsets to support unbiased experimental validation. The training subset was used for behavioral representation learning, anomaly detection optimization, ensemble model training, and probability calibration, whereas the testing subset was reserved for independent operational evaluation and performance assessment. To preserve realistic operational conditions and reduce temporal information leakage, transaction records were processed chronologically according to transaction timestamps. All behavioral features were computed exclusively from historical observations available before the evaluated transaction, thereby preventing temporal information leakage during feature construction.

The experiments were conducted on a standard workstation-class computer using multi-core CPU processing. GPU acceleration was not required because the proposed framework was designed for practical enterprise deployment using commodity hardware. The experiments were conducted using batch-oriented analytical execution to simulate realistic enterprise financial monitoring conditions. The environment additionally incorporated visualization and monitoring components for analyzing anomaly score distributions, transaction behavior patterns, operational activity dynamics, feature correlations, and explainability outputs.

Overall, the experimental environment provided a scalable and reproducible infrastructure for evaluating intelligent financial monitoring, explainable anomaly detection, calibrated risk scoring, and blockchain-assisted audit verification within enterprise-oriented salary advance FinTech systems. The implementation was intentionally designed to prioritize reproducibility, operational scalability, and enterprise deployment feasibility rather than computational optimization on specialized hardware.

To further assess the stability of the obtained results, bootstrap confidence intervals were estimated for the principal evaluation metrics, including ROC-AUC, PR-AUC, and Brier score. These confidence intervals provide an additional assessment of the robustness of the reported predictive performance.

The principal implementation parameters used throughout the experimental evaluation are summarized in Table 1. These settings are reported to improve methodological transparency and facilitate independent implementation of the proposed framework using alternative salary advance datasets while preserving the confidentiality of the enterprise data.

Table 1. Experimental configuration of the proposed ABAF framework.

Component	Configuration
Dataset	52,846 anonymized salary advance transactions collected from an enterprise financial environment.
Data partition	Chronological train/test split (80% training, 20% testing) preserving the original anomaly proportion as closely as possible.
Cross-validation	Stratified five-fold cross-validation performed on the training set only.
Feature scaling	RobustScaler.
Risk features	Total advances, average amount, maximum amount, coefficient of variation, amount skewness, behavioral indicators, historical transaction profile features, and temporal activity characteristics.
Gradient Boosting	300 estimators; maximum tree depth = 4; learning rate = 0.05; subsample ratio = 0.8; minimum samples per leaf = 5; random state = 42.
Random Forest	300 estimators; maximum tree depth = 7; minimum samples per leaf = 5; balanced class weighting; random state = 42.
Extra Trees	300 estimators; maximum tree depth = 7; minimum samples per leaf = 5; balanced class weighting; random state = 42.
Ensemble prediction	Mean probability averaging across the trained classifiers.
Behavioral anomaly detection	Isolation Forest and MLP-based reconstruction model integrated through the Adaptive Behavioral Anomaly Fusion (ABAF) mechanism.
Explainability	Permutation feature importance and SHAP analysis.
Calibration assessment	Calibration curves, Brier Score, Expected Calibration Error (ECE), Maximum Calibration Error (MCE), and reliability diagrams.
Robustness assessment	Stratified five-fold cross-validation and bootstrap confidence intervals for ROC-AUC, PR-AUC, and Brier Score.
Evaluation metrics	Accuracy, Precision, Recall, F1-score, ROC-AUC, PR-AUC, Brier Score, ECE, and MCE.
Audit verification	SHA-256 hashing with Merkle-root integrity verification.
Implementation	Python 3.11 implementation using Scikit-learn 1.5.2, Pandas 2.2.3, NumPy 2.1.2, Matplotlib 3.9.2, Seaborn 0.13.2, and SHAP 0.46.0.

The experimental implementation follows the proposed multi-stage monitoring pipeline summarized in Table 1. Model robustness was evaluated using stratified five-fold cross-validation together with bootstrap confidence intervals. Formal statistical significance testing between competing models was not performed because the objective of this study was to evaluate the proposed integrated monitoring architecture rather than conduct comparative classifier benchmarking.

4.3. Leakage Prevention and Robust Validation

During preliminary experimental analysis, several engineered behavioral features exhibited excessively strong predictive influence associated with the operational anomaly labels used for monitoring. Additional investigation revealed that certain aggregated indicators, including anomaly-rate-related behavioral statistics and operational frequency summaries, introduced information leakage capable of artificially inflating predictive performance.

To ensure reliable and realistic operational evaluation, a dedicated leakage prevention procedure was incorporated into the experimental pipeline. Features directly or indirectly associated with target-derived anomaly aggregation were identified during the preliminary exploratory analysis. Although these variables are shown in Figure 5 to illustrate the initial feature relationships, they were excluded before model training and evaluation. In particular, variables related to anomaly-frequency aggregation, anomaly concentration, and operational anomaly-rate statistics were removed to construct the final leak-free analytical feature space.

Following leakage analysis, all anomaly detection and ensemble risk scoring models were retrained using the corrected feature representation. The final experimental results reported in this study therefore correspond exclusively to the leak-free analytical configuration.

In addition, probability calibration was applied to the supervised ensemble models after leakage removal, while anomaly detection performance was evaluated using an independent test set. The resulting performance metrics therefore provide a more realistic assessment of anomaly detection capability, operational robustness, and explainable financial monitoring performance within enterprise-oriented salary advance FinTech environments.

The final leak-free configuration produced stable anomaly detection performance without unrealistically perfect predictive metrics, indicating improved generalization capability and substantially reduced information leakage.

To improve temporal robustness and better simulate realistic enterprise monitoring conditions, the dataset was partitioned chronologically rather than randomly. Earlier transaction records were used for training and calibration, whereas later periods were reserved for independent testing. Moreover, all historical behavioral profiles were computed exclusively from observations preceding the evaluated transaction, preventing future-information leakage.

Overall, the leakage prevention procedure improved the methodological validity of the proposed framework by ensuring that all reported performance metrics were obtained without target leakage or future-information contamination.

4.4. Evaluation Metrics

The proposed hybrid Blockchain–AI framework was evaluated using multiple complementary metrics designed to assess anomaly detection performance, probabilistic reliability, calibration quality, and operational monitoring robustness under naturally imbalanced salary advance transaction conditions.

Since operational financial datasets typically contain substantially fewer anomalous transactions than normal financial activities, relying solely on overall classification accuracy may produce misleading performance interpretations. Therefore, the experimental evaluation incorporated several complementary performance metrics capable of assessing anomaly detection sensitivity, false-positive behavior, and operational classification reliability under realistic enterprise-oriented financial monitoring conditions.

The evaluation framework focused on the following analytical objectives:

• Detection accuracy of anomalous financial transactions;
• Reliability of transaction-level financial risk estimation;
• Robustness under imbalanced operational conditions;
• Sensitivity to suspicious behavioral transaction patterns;
• Operational trustworthiness of explainable monitoring mechanisms.

The proposed framework was evaluated using the following performance metrics:

• Accuracy;
• Precision;
• Recall;
• F1-score;
• Receiver Operating Characteristic Area Under Curve (ROC-AUC);
• Precision–Recall Area Under Curve (PR-AUC);
• Brier Score.

Accuracy measures the overall proportion of correctly classified operational financial transactions. However, because anomaly detection datasets frequently contain highly imbalanced class distributions, additional metrics emphasizing anomaly detection quality were incorporated into the evaluation framework.

Precision measures the proportion of correctly identified anomalies among all transactions classified as suspicious. High precision indicates effective reduction of false-positive operational alerts and improved monitoring trustworthiness. High precision values indicate effective reduction of false-positive operational alerts and improved monitoring trustworthiness.

Recall measures the capability of the framework to identify anomalous and suspicious operational financial behaviors. High recall indicates improved sensitivity to abnormal transaction activities. High recall values indicate improved sensitivity to abnormal transaction activities and stronger operational anomaly detection performance.

The F1-score combines precision and recall into a single balanced performance measure. It is particularly informative under imbalanced financial monitoring conditions. This metric is particularly important under imbalanced financial monitoring conditions where both anomaly detection sensitivity and false-positive control are operationally significant.

ROC-AUC evaluates the ability of the framework to distinguish anomalous from normal transactions across different decision thresholds. ROC-AUC measures the capability of the framework to distinguish anomalous financial behaviors from normal operational transaction activities across varying classification thresholds.

PR-AUC provides a more informative assessment of anomaly detection performance under severe class imbalance by emphasizing anomaly identification quality and positive predictive performance. PR-AUC provides a more informative assessment of anomaly detection effectiveness under rare-event operational conditions by emphasizing anomaly identification quality and positive predictive performance.

The Brier Score evaluates the calibration quality of predicted transaction-level risk probabilities. Lower values indicate better agreement between predicted risk estimates and observed outcomes. Lower Brier Score values indicate improved probabilistic consistency between predicted financial risk estimates and observed operational outcomes. Calibration metrics were evaluated only for the supervised ensemble risk-scoring models because the unsupervised anomaly detectors do not directly produce calibrated posterior probabilities.

Table 2 summarizes the evaluation metrics utilized during experimental analysis of the proposed framework. The evaluation metrics therefore assess complementary aspects of the proposed framework, including anomaly detection capability, probability calibration, and operational monitoring reliability rather than a single predictive objective.

Table 2. Evaluation metrics used for performance assessment of the proposed hybrid Blockchain–AI framework.

Metric	Purpose
Accuracy	Overall classification correctness
Precision	Reliability of detected anomalous transactions
Recall	Sensitivity to anomalous financial behaviors
F1-score	Balanced evaluation of precision and recall
ROC-AUC	Threshold-independent discrimination capability
PR-AUC	Performance assessment under imbalanced anomaly conditions
Brier Score	Calibration quality and probabilistic reliability of predicted risk scores

The explainability analysis was performed on the supervised ensemble risk-scoring layer. BRDI itself was not interpreted through SHAP because it functions as an adaptive control variable within the anomaly fusion stage rather than as an ordinary predictive feature.

To improve experimental reliability, all evaluation metrics were computed using an independent testing subset separated from model training. Chronological transaction ordering was preserved during evaluation to minimize temporal information leakage.

Overall, the selected evaluation framework provides a comprehensive assessment of predictive performance, calibration quality, explainability, and operational monitoring capability under realistic enterprise salary advance conditions. The reported metrics should therefore be interpreted as complementary rather than relying on any single performance indicator.

4.5. Anomaly Detection Performance

The experimental evaluation demonstrated that the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion (ABAF) approach effectively identifies suspicious financial behaviors, operational irregularities, and evolving transaction anomalies within enterprise-oriented salary advance FinTech environments. The reported results correspond to the final leak-free validation configuration described in Section 4.3. The evaluation was conducted at two distinct analytical levels. The unsupervised anomaly detection stage operated on the complete transaction-level dataset containing 52,846 salary advance records. For the subsequent explainable ensemble monitoring stage, the transaction records were aggregated by employee, resulting in 1999 employee-level behavioral profiles. An operational HIGH_RISK monitoring label was constructed from predefined behavioral conditions involving transaction error rate, the occurrence of transaction-level anomalies, and off-hours activity. This procedure identified 514 employee profiles, corresponding to 25.7% of the employee-level dataset, as requiring elevated operational attention. The employee-level dataset was then divided using a stratified 80:20 train–test split. By combining Isolation Forest anomaly detection with reconstruction-based behavioral anomaly analysis, the proposed framework achieved strong operational robustness under imbalanced financial monitoring conditions characterized by sparse anomaly occurrence and evolving transaction behaviors.

The hybrid anomaly detection strategy combines Isolation Forest with reconstruction-based behavioral analysis to capture both statistical outliers and nonlinear behavioral irregularities. The complementary detectors improve anomaly identification stability and operational robustness under heterogeneous financial transaction conditions compared with individual detection models.

The transaction-level anomaly analysis was conducted using the complete dataset of 52,846 salary advance transactions. In contrast, the classification metrics reported for the explainable ensemble monitoring models in Table 3 and Table 4, as well as the ROC and Precision–Recall curves presented in Figure 6, were computed using the stratified employee-level hold-out test set. The test set contained 400 employee profiles, including 103 profiles assigned the operational HIGH_RISK monitoring label. Consequently, the positive-class prevalence in the test set was 0.2575, rounded to 0.258, which represents the random precision baseline shown in the Precision–Recall curve.

Table 3. Anomaly detection performance of the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion (ABAF) framework.

Metric	Result
Accuracy	91.25%
Precision	80.91%
Recall	86.41%
F1-score	83.57%
ROC-AUC	0.967
PR-AUC	0.929

Table 4. Comparative performance analysis of ensemble learning models and the proposed ABAF-based monitoring framework.

Model	Accuracy	Precision	Recall	F1-Score	ROC-AUC	PR-AUC
Gradient Boosting	91.02%	80.34%	85.91%	83.03%	0.9695	0.9289
Random Forest	90.88%	80.11%	85.63%	82.78%	0.9694	0.9291
Extra Trees	89.74%	78.02%	83.54%	80.69%	0.9596	0.9142
Proposed ABAF Framework	91.25%	80.91%	86.41%	83.57%	0.9671	0.9288

Figure 6. ROC and Precision–Recall curves of the ensemble monitoring models evaluated on the stratified employee-level hold-out test set ($n=400$). The Precision–Recall random baseline of 0.258 corresponds to the prevalence of the operational HIGH_RISK monitoring label in the test set (103 of 400 employee profiles) and not to the prevalence of transaction-level anomalies in the complete dataset.

Table 3 summarizes the anomaly detection performance obtained during experimental evaluation.

To further investigate the behavior of the proposed behavioral state representation, additional analysis was conducted using BRDI. Behaviorally anomalous transactions consistently exhibited higher BRDI values than operationally normal transactions. However, BRDI should not be interpreted as an independent fraud predictor. Instead, it summarizes complementary behavioral descriptors and provides the adaptive control signal governing the ABAF mechanism.

The obtained results demonstrate strong anomaly detection capability under realistic enterprise financial conditions, balancing false-positive control with high sensitivity to behaviorally unusual transactions.

To further evaluate the effectiveness of the proposed architecture, comparative analysis against baseline ensemble learning models was conducted.

Table 4 displays the comparative performance analysis of baseline ensemble models and the proposed hybrid monitoring framework.

Although Gradient Boosting and Random Forest achieved marginally higher ROC-AUC or PR-AUC values, the observed differences were very small. Since the objective of the proposed framework is to provide an integrated behavioral monitoring architecture rather than to optimize a single classification metric, the comparative analysis should be interpreted in conjunction with the ablation study presented below.

To further evaluate the contribution of the major architectural components, an ablation-oriented comparative analysis was conducted. The results indicate that behavioral drift modeling, BRDI, and adaptive anomaly fusion contribute to improved anomaly discrimination capability and balanced anomaly detection performance compared with individual anomaly detection models operating independently.

Table 5 summarizes the ablation analysis conducted to evaluate the individual contributions of the proposed Behavioral Risk Deviation Index (BRDI) and Adaptive Behavioral Anomaly Fusion (ABAF) mechanism.

Table 5. Ablation study of BRDI and Adaptive Behavioral Anomaly Fusion (ABAF).

Configuration	ROC-AUC	PR-AUC	F1-Score
Isolation Forest only	0.910	0.840	0.770
Reconstruction-based anomaly model only	0.920	0.860	0.790
Fixed anomaly fusion	0.950	0.910	0.820
Fixed fusion + BRDI	0.960	0.920	0.830
Adaptive Fusion (ABAF)	0.967	0.929	0.836
Full Framework	0.967	0.929	0.836

Note: Bold values indicate the performance of the complete proposed framework.

The identical predictive metrics obtained for the Adaptive Fusion (ABAF) configuration and the Full Framework indicate that the additional explainability, probability calibration, and cryptographic audit components are designed to enhance interpretability, calibration quality, and auditability rather than to modify the underlying predictive model. Consequently, these components do not alter the classification performance reported in this table. This observation confirms that the additional explainability, calibration, and audit components improve operational usability without introducing additional predictive complexity into the anomaly detection pipeline.

The ablation study demonstrates that both BRDI and ABAF contribute to improved anomaly detection performance. BRDI enhances behavioral representation by incorporating behavioral drift, temporal irregularity, burst activity, transaction velocity, and entropy-based instability, whereas ABAF adaptively adjusts detector contributions according to employee-specific behavioral states. Together, these mechanisms improve discrimination capability and robustness compared with fixed anomaly fusion.

The proposed Adaptive Behavioral Anomaly Fusion mechanism achieved additional performance gains by dynamically adjusting the contribution of statistical and behavioral anomaly estimators according to the behavioral risk state of each transaction. Compared with fixed anomaly fusion, ABAF improved anomaly discrimination performance across all evaluation metrics, demonstrating greater robustness under evolving behavioral conditions and heterogeneous transaction patterns. The adaptive weighting mechanism should therefore be interpreted as an operational prioritization strategy that adjusts detector contributions according to employee-specific behavioral states rather than as an optimization procedure intended solely to maximize predictive accuracy.

The complete framework maintained the performance improvements achieved by ABAF while additionally providing calibrated risk estimation, explainability, and blockchain-assisted auditability. These additional capabilities improve operational usability and trustworthiness without sacrificing anomaly detection performance.

Figure 6 presents the ROC and Precision–Recall curves of the ensemble monitoring models evaluated on the stratified employee-level hold-out test set. The curves therefore represent discrimination between employee profiles assigned and not assigned the operational HIGH_RISK monitoring label, rather than discrimination between the 2417 transaction-level anomalies and the remaining transactions in the complete dataset.

The ROC and Precision–Recall analyses demonstrate that the evaluated ensemble models distinguish effectively between employee profiles assigned and not assigned the operational HIGH_RISK monitoring label within the hold-out test set. Because the positive-class prevalence in this employee-level test set was 0.258, the corresponding horizontal Precision–Recall baseline is substantially higher than the 4.57% transaction-level anomaly proportion observed in the complete dataset. These percentages describe different analytical units and should therefore not be interpreted as inconsistent estimates of the same class prevalence.

For visualization purposes, Figure 7 presents a representative confusion matrix illustrating the distribution of predicted and observed classes. This visualization is intended only to demonstrate classification behavior and does not replace the quantitative evaluation performed on the complete test dataset.

Figure 7. Confusion matrix of the best-performing ensemble monitoring model evaluated on the employee-level hold-out test set ($n=400$).

Figure 7 presents the confusion matrix obtained for the best-performing ensemble model on the complete employee-level hold-out test set. The matrix therefore summarizes classification outcomes for the same 400 employee profiles used to construct the ROC and Precision–Recall curves in Figure 6.

The confusion matrix demonstrates that the proposed framework successfully identifies the majority of anomalous financial activities while maintaining relatively low false-positive operational classifications. These findings are particularly important for enterprise financial monitoring environments where excessive false alerts may negatively affect operational efficiency and analyst trust.

Figure 8 illustrates the distribution of hybrid anomaly scores generated by the proposed framework.

Figure 8. Distribution of adaptive anomaly scores produced by the proposed ABAF framework.

The dashed threshold lines indicate operational anomaly boundaries used during hybrid anomaly severity estimation.

The anomaly score distributions demonstrate clear behavioral separation between normal operational activities and anomalous transaction behaviors. The proposed ABAF mechanism generates elevated anomaly severity estimates for suspicious operational activities while preserving stable clustering of legitimate transaction behavior. The observed separation confirms the effectiveness of adaptive behavioral anomaly fusion and supports the role of BRDI in distinguishing evolving behavioral anomalies from normal operational activity. Because BRDI is computed relative to employee-specific historical behavioral profiles, elevated anomaly scores indicate deviations requiring further operational assessment rather than direct evidence of fraudulent behavior.

As shown in Table 6, anomalous transactions exhibited substantially higher behavioral drift and BRDI values than normal transactions.

Table 6. Behavioral drift and BRDI statistics.

Group	Mean Drift Score	Mean BRDI
Normal transactions	0.19	0.24
Anomalous transactions	0.68	0.77

Anomalous transactions exhibited substantially higher behavioral drift and BRDI values than normal transactions. These observations indicate that BRDI differentiates transaction groups according to changes in behavioral characteristics relative to employees’ historical profiles. However, the observed separation should be interpreted as evidence of behavioral state differentiation within the proposed monitoring framework rather than as proof that BRDI independently distinguishes opportunistic fraud from broader organizational or socio-economic behavioral changes. Consequently, BRDI supports behavioral monitoring and adaptive anomaly prioritization rather than causal inference regarding the origin of behavioral change.

Overall, the experimental results demonstrate that the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion framework provides a robust and operationally interpretable monitoring architecture for enterprise salary advance systems. Its principal contribution lies in combining behavioral drift modeling, adaptive anomaly fusion, explainable risk assessment, calibrated probability estimation, and cryptographically verifiable auditability within a unified operational framework rather than in maximizing any individual predictive metric.

4.6. Explainable Risk Scoring Analysis

In addition to anomaly detection performance evaluation, the proposed hybrid Blockchain–AI framework incorporates explainable risk scoring mechanisms designed to improve operational transparency, interpretability, and decision-support reliability within enterprise-oriented financial monitoring environments. Since financial anomaly detection systems frequently operate in high-risk and regulation-sensitive domains, explainability mechanisms are critically important for supporting operational accountability, analyst trust, and interpretable financial decision-making.

The explainable risk scoring layer integrates ensemble learning models together with SHAP-based feature contribution analysis to estimate transaction-level financial risk while simultaneously identifying the operational factors influencing anomaly classification outcomes. This approach enables the framework not only to detect suspicious operational behaviors but also to provide interpretable explanations regarding why particular transactions were classified as anomalous or high risk.

The experimental analysis demonstrated that behavioral transaction indicators and the adaptive anomaly score generated by the ABAF mechanism contributed to transaction-level risk estimation. BRDI itself was not used as a direct predictive feature within the final ensemble classifier. Instead, it regulated the adaptive fusion of the Isolation Forest and reconstruction-based anomaly detectors, thereby indirectly influencing the anomaly score supplied to the explainable risk-scoring model.

The explainability evaluation demonstrated that behavioral state representations provide richer contextual explanations than conventional transaction-level monitoring based solely on individual financial indicators.

Although the Adaptive Behavioral Anomaly Fusion mechanism dynamically adjusts the contribution of the statistical and reconstruction-based anomaly detectors, the explainability analysis is performed after completion of the anomaly fusion process using the final ensemble risk-scoring model. This architectural separation resolves the potential transparency paradox associated with adaptive anomaly fusion. Although detector contributions vary according to employee-specific behavioral states, the final explainability analysis is always anchored to a fixed ensemble classifier operating on calibrated anomaly scores. Consequently, explanations remain stable, reproducible, and suitable for operational auditing and regulatory review despite the adaptive behavior of the upstream monitoring components.

Figure 9 illustrates the permutation-based global feature importance analysis generated during explainable risk scoring evaluation.

Figure 9. Permutation-based global feature importance measured as the mean decrease in ROC-AUC after feature permutation.

The explainability analysis demonstrates that transaction variability and amount-related characteristics are the dominant predictors within the final ensemble classifier. Rather than relying on a single financial indicator, the model combines behavioral, temporal, and operational transaction characteristics, providing more robust and context-aware financial risk estimation.

Figure 10 presents the tree-based feature importance distribution generated by the ensemble risk scoring model.

Figure 10. Tree-based feature importance scores obtained from the final ensemble risk scoring model.

Although the feature rankings differ across explainability methods, both analyses consistently identify transaction variability and amount-related characteristics as the dominant predictors used by the final ensemble classifier. It should also be emphasized that BRDI is intentionally excluded from the feature-importance rankings because it functions as an adaptive control variable within the ABAF mechanism rather than as an explanatory feature used directly by the downstream ensemble classifier.

The explainable risk-scoring mechanism improves operational interpretability by enabling analysts to identify the behavioral and financial factors underlying anomaly predictions. Integrating explainability directly into the monitoring pipeline ensures consistency between anomaly detection, calibrated risk estimation, and auditability.

The explainability-oriented experimental results also support the operational suitability of the proposed framework for high-risk financial monitoring environments requiring transparent anomaly detection, interpretable risk assessment, and trustworthy AI-assisted decision support. By combining behavioral drift-aware anomaly detection, BRDI-guided adaptive anomaly fusion, interpretable ensemble learning, and behavioral transaction analytics, the proposed framework provides a more transparent and operationally accountable financial monitoring infrastructure.

Overall, the explainable risk-scoring analysis demonstrates that the proposed framework combines strong anomaly detection with transparent transaction-level risk assessment. By integrating adaptive anomaly fusion, explainable ensemble learning, and blockchain-assisted auditability, the framework improves operational transparency and decision-support reliability in enterprise salary advance monitoring.

4.7. Explainability of Adaptive Fusion Dynamics

Although the Adaptive Behavioral Anomaly Fusion (ABAF) mechanism utilizes a deterministic weighting function, understanding how individual behavioral descriptors influence the adaptive fusion process is essential for operational transparency. While the SHAP analysis presented in the previous section explains the behavior of the downstream ensemble risk-scoring model, it does not explicitly describe the adaptive state transitions occurring within the ABAF mechanism itself.

To improve interpretability of the adaptive fusion process, an additional sensitivity analysis was conducted to quantify how variations in the behavioral descriptors comprising the Behavioral Risk Deviation Index (BRDI) influence the adaptive fusion coefficient.

The adaptive fusion coefficient is computed according to the adaptive weighting function introduced in Equation (9), which establishes a deterministic nonlinear relationship between the estimated behavioral state and the relative contribution of the reconstruction-based anomaly detector.

Since BRDI is computed as the weighted aggregation defined in Equation (5), changes in the individual behavioral descriptors indirectly modify the adaptive fusion coefficient through their influence on BRDI. Consequently, the interpretability of the adaptive weighting process can be analyzed by examining how variations in the individual behavioral descriptors propagate through BRDI and subsequently affect the value of $\alpha$.

To investigate this relationship, a local one-factor-at-a-time sensitivity analysis was performed. Each behavioral descriptor was independently perturbed by +0.10 while the remaining descriptors were held constant. The corresponding variation of the adaptive fusion coefficient was then computed using Equation (9).

Figure 11 illustrates the deterministic relationship between BRDI and the adaptive fusion coefficient. The figure also visualizes the continuous state transition governing the relative contribution of the two anomaly detectors as behavioral conditions evolve.

Figure 11. Relationship between the Behavioral Risk Deviation Index (BRDI) and the adaptive fusion coefficient $\alpha$ illustrating the continuous transition of detector weights within the proposed ABAF mechanism.

Because BRDI is computed as a linear combination of five equally weighted behavioral descriptors, perturbing any individual descriptor produces a proportional change in BRDI and consequently a predictable variation of the adaptive fusion coefficient according to Equation (9). For example, increasing any normalized behavioral descriptor by 0.10 increases BRDI by 0.02 and raises the adaptive fusion coefficient from 0.333 to 0.342 when evaluated at $BRDI=0.50$, corresponding to an increase of approximately $\Delta \alpha =0.009$. This deterministic propagation enables complete analytical tracing of the adaptive weighting process from the underlying behavioral descriptors to the final anomaly fusion coefficient.

The monotonic nonlinear relationship demonstrates that the influence of the reconstruction-based anomaly detector increases smoothly as behavioral instability grows. For relatively stable behavioral conditions, the fusion process remains dominated by the Isolation Forest component. As behavioral deviation increases, the reconstruction-based detector gradually receives greater influence without introducing abrupt state transitions.

Table 7 illustrates how perturbations in individual behavioral descriptors propagate through BRDI and affect the adaptive fusion coefficient $\alpha$.

Table 7. Illustrative propagation of behavioral descriptor perturbations through BRDI to the adaptive fusion coefficient.

Behavioral Descriptor	Perturbation	ΔBRDI	$\Delta \alpha$
Behavioral drift	+0.10	+0.02	+0.009
Behavioral entropy	+0.10	+0.02	+0.009
Transaction velocity	+0.10	+0.02	+0.009
Burst activity	+0.10	+0.02	+0.009
Temporal irregularity	+0.10	+0.02	+0.009

Table 8 summarizes representative examples of adaptive fusion behavior for different behavioral states.

Table 8. Illustrative adaptive fusion behavior under different behavioral conditions.

BRDI	$\mathit{\alpha }$	Dominant Detector	Behavioral State
0.20	0.17	Isolation Forest	Stable
0.45	0.31	Balanced fusion	Moderate drift
0.80	0.44	Reconstruction-biased fusion	Elevated drift
1.20	0.55	Reconstruction	Strong behavioral instability

The sensitivity analysis demonstrates that the adaptive fusion coefficient changes continuously rather than discretely as behavioral conditions evolve. Consequently, the ABAF mechanism does not perform abrupt switching between anomaly detectors but instead gradually reallocates their relative influence according to the estimated behavioral state.

This additional analysis complements the downstream SHAP explanations presented in the previous section. Whereas SHAP quantifies the contribution of the predictors used by the final ensemble risk-scoring model, the present local sensitivity analysis explicitly characterizes the adaptive state transitions governing the anomaly fusion mechanism itself. Together, the local sensitivity analysis of the adaptive fusion coefficient and the SHAP-based explanation of the downstream ensemble classifier provide complementary interpretability at two different levels of the proposed framework. The sensitivity analysis demonstrates how the behavioral descriptors composing BRDI regulate the adaptive weighting mechanism, whereas SHAP attributes the contribution of the resulting adaptive anomaly information to the final transaction-level risk estimation. Consequently, the proposed framework provides explicit interpretability for both the upstream adaptive fusion process and the downstream supervised decision model, thereby resolving the transparency gap between the adaptive anomaly fusion mechanism and the downstream explainable risk-scoring model.

4.8. Blockchain Audit Verification Analysis

In addition to intelligent anomaly detection and explainable financial risk estimation, the proposed Behavioral Drift-Aware Adaptive Anomaly Fusion (ABAF) framework incorporates blockchain-assisted audit verification mechanisms designed to improve operational integrity, transaction traceability, and tamper-resistant financial monitoring within enterprise-oriented salary advance FinTech environments. The blockchain-assisted audit layer provides immutable verification structures capable of supporting trustworthy operational monitoring and transparent financial accountability.

It should be noted that the blockchain-assisted audit layer is designed to preserve the integrity and traceability of analytical outputs rather than to improve anomaly detection performance. Its primary function is to provide immutable evidence supporting subsequent operational review, compliance verification, and audit reconstruction.

The blockchain-assisted audit layer records transaction verification hashes, anomaly assessment outputs, behavioral states, and audit artefacts within immutable cryptographic structures, enabling reliable transaction reconstruction, integrity verification, and operational traceability.

The blockchain-assisted verification layer was implemented using lightweight cryptographic integrity mechanisms based on SHA-256 hashing and Merkle-root transaction aggregation procedures. Each operational financial transaction processed by the framework generates a unique verification hash representing transaction metadata, behavioral indicators, anomaly scores, risk estimation outputs, and operational processing states. These cryptographic records are subsequently aggregated into hierarchical verification structures capable of supporting efficient integrity validation and tamper detection.

The experimental analysis demonstrated that blockchain-assisted audit verification mechanisms successfully preserve transaction integrity while maintaining compatibility with scalable AI-driven financial monitoring workflows. Unlike conventional centralized logging infrastructures vulnerable to unauthorized modification or operational inconsistency, the proposed blockchain-assisted architecture provides immutable operational traceability capable of supporting transparent audit verification and trustworthy financial monitoring.

Figure 12 illustrates the operational workflow of blockchain-assisted transaction verification and audit traceability within the proposed framework.

Figure 12. Blockchain-assisted audit workflow for transaction traceability and integrity verification.

The audit verification workflow demonstrates how operational financial transactions are sequentially processed through behavioral profiling, behavioral drift modeling, anomaly detection, explainable risk scoring, cryptographic hashing, and immutable audit registration procedures. The proposed architecture ensures that analytical outputs generated by the behavioral drift modeling, BRDI estimation, ABAF-based anomaly detection, and explainable risk scoring layers remain transparently linked with corresponding financial transaction states and operational verification artifacts. Importantly, the blockchain layer records the final calibrated risk scores, adaptive anomaly scores, and explainability outputs after completion of the analytical pipeline. Consequently, the audit records remain stable over time and provide a reproducible representation of the analytical decision available at the time of transaction processing.

Immutable audit records enable analysts to reconstruct transaction histories, verify anomaly detection decisions, validate analytical consistency, and support post-event investigations.

To evaluate audit integrity robustness, controlled transaction modification experiments were additionally conducted during system validation. The experimental results demonstrated that even minimal unauthorized modifications to transaction records generated immediate cryptographic hash inconsistencies within the audit verification layer. These findings confirm the effectiveness of the proposed blockchain-assisted integrity mechanisms for detecting operational tampering attempts and preserving trustworthy transaction traceability. The blockchain-assisted verification mechanism therefore complements the explainable monitoring architecture by preserving immutable evidence of the analytical outputs rather than modifying the anomaly detection process itself.

Figure 13 presents an example of cryptographic integrity verification and hash consistency validation within the proposed framework.

Figure 13. Cryptographic integrity validation using SHA-256 hashing and Merkle-root verification under normal and tampered transaction conditions. The asterisk (*) denotes a value affected by transaction tampering.

The integrity validation analysis demonstrates that the proposed blockchain audit layer effectively preserves immutable transaction relationships and enables efficient verification of operational financial records. The cryptographic verification mechanisms additionally support scalable audit consistency checking without introducing substantial computational overhead into the financial monitoring pipeline.

An important advantage of the proposed architecture is the separation between AI-driven analytical intelligence and immutable audit verification mechanisms. This layered design enables the framework to maintain high analytical flexibility and adaptive anomaly detection capability while simultaneously preserving strong operational traceability and trustworthy financial auditability.

Unlike the predictive components of the framework, the blockchain-assisted audit layer operates after risk inference and adaptive anomaly fusion have been completed. Consequently, cryptographic verification does not influence behavioral modeling, anomaly detection, or risk prioritization decisions, thereby avoiding algorithmic feedback between historical audit records and subsequent model predictions. Instead, Merkle-root validation preserves immutable evidence of behavioral descriptors, anomaly scores, and final risk assessments, enabling transparent retrospective verification, regulatory compliance, and independent auditing even when behavioral baselines or predictive models are updated over time. This separation ensures that future improvements to the anomaly detection models do not compromise previously recorded audit evidence.

Overall, the blockchain audit verification analysis demonstrates that the proposed framework provides a practical mechanism for preserving transaction integrity, analytical traceability, and audit-oriented accountability within enterprise salary advance environments. Rather than improving predictive accuracy, the blockchain-assisted audit layer complements the behavioral monitoring architecture by providing immutable verification of anomaly scores, explainability outputs, and operational decisions, thereby strengthening transparency, governance, and regulatory readiness.

4.9. Stress Testing Under Population-Level Behavioral Shift

Unlike the experiments reported in the previous sections, which evaluate the proposed framework under ordinary operating conditions, the following stress-testing experiment intentionally violates the localized behavioral drift assumption. The objective is to investigate whether the proposed monitoring architecture can computationally distinguish organization-wide behavioral shifts from employee-specific behavioral anomalies and initiate an appropriate recalibration procedure.

To emulate organization-wide behavioral change, the behavioral descriptors used for BRDI computation (transaction frequency, transaction amount, and temporal activity) were simultaneously shifted for all monitored employees by controlled synthetic perturbations of increasing magnitude, thereby generating moderate and severe population-level behavioral shift scenarios while preserving the original transaction structure.

For each simulated observation period, BRDI values were computed using the standard behavioral state modeling procedure described in Section 3.3. In addition to transaction-level BRDI estimation, the following population-level monitoring statistic was introduced:

$$PDI={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{\mathit{BRDI}}_i$$

(16)

where $PDI$ denotes the Population Drift Index representing the average behavioral deviation across all monitored employees. Unlike BRDI, which is computed individually for each employee, PDI summarizes the behavioral state of the monitored population and is used exclusively for detecting organization-wide behavioral changes.

Whenever

$$PDI>{\tau }_{pop},$$

(17)

the monitoring framework interprets the observed behavioral change as a population-level behavioral shift rather than employee-specific behavioral anomalies.

Instead of continuing ordinary employee prioritization, the framework temporarily suspends adaptive anomaly prioritization and initiates behavioral baseline recalibration before normal monitoring resumes.

Figure 14 illustrates the proposed population-level drift monitoring workflow.

Figure 14. Population-level drift detection and behavioral baseline recalibration.

The workflow illustrates the supervisory procedure triggered whenever population-level behavioral drift is detected. Under these conditions, employee-level anomaly prioritization is temporarily suspended until behavioral baselines have been recalibrated.

Table 9 summarizes the results of the synthetic stress-testing scenarios under normal, moderate, and severe population-level behavioral shift conditions.

Table 9. Stress-testing results under simulated population-level behavioral shift.

Scenario	Mean Employee BRDI	Population Drift	Action
Normal operation	0.24	No	Normal ABAF
Moderate shift	0.46	Yes	Baseline recalibration
Severe shift	0.71	Yes	Baseline recalibration

As shown in Table 9, the normal operating scenario produced a mean employee BRDI of 0.24 and did not trigger the population-drift condition. In contrast, the moderate and severe shift scenarios increased the mean employee BRDI to 0.46 and 0.71, respectively, causing the framework to suspend employee-level prioritization and initiate behavioral baseline recalibration. These results demonstrate that increasing population-wide behavioral deviation consistently activates the supervisory recalibration mechanism while preventing inappropriate employee-level anomaly prioritization.

The simulation demonstrates that the proposed monitoring architecture remains operational when the localized behavioral drift assumption is violated. Rather than interpreting simultaneous increases in employee BRDI values as widespread individual anomalies, the framework identifies the emergence of population-level behavioral drift through the Population Drift Index. Once detected, behavioral baseline recalibration is initiated before employee-level anomaly prioritization resumes.

Consequently, the proposed framework no longer relies solely on an implicit localized-drift assumption. Instead, it explicitly detects violations of this assumption, distinguishes population-level behavioral shifts from localized employee-level anomalies, and initiates an automatic behavioral baseline recalibration procedure before normal employee-level prioritization resumes.

Importantly, the proposed stress-testing extension does not modify the ABAF algorithm itself. Instead, it introduces a supervisory monitoring layer responsible for detecting organization-wide behavioral shifts and initiating behavioral baseline recalibration before ordinary employee-level adaptive anomaly monitoring resumes. This additional supervisory mechanism addresses the principal limitation of localized behavioral monitoring by providing an explicit computational response when the underlying behavioral assumptions of the framework are systematically violated.

4.10. Cryptographic Governance of Behavioral Baseline Recalibration

The stress-testing scenario presented in the previous section introduces an additional governance requirement beyond anomaly detection alone. Whenever population-level behavioral drift is detected, the monitoring framework initiates a behavioral baseline recalibration procedure before employee-level anomaly prioritization resumes. From an enterprise governance perspective, such recalibration constitutes a modification of the analytical reference model and therefore must itself become an auditable event.

To preserve both behavioral adaptability and audit integrity, the proposed framework introduces a cryptographic governance mechanism for behavioral baseline recalibration. Rather than overwriting the existing behavioral baseline, each recalibration generates a new immutable baseline version while preserving all previous behavioral profiles and analytical results. Consequently, every transaction remains permanently associated with the behavioral baseline version under which it was originally evaluated.

Each baseline recalibration event generates a governance record containing the baseline version identifier, recalibration timestamp, Population Drift Index (PDI), recalibration reason, the corresponding Merkle root, and optional authorization metadata documenting administrative approval.

The cryptographic governance record is represented as

$$G_i=\mathrm{SHA}256\left({\mathit{Version}}_i\Vert {\mathit{Timestamp}}_i\Vert {\mathit{PDI}}_i\Vert {\mathit{Reason}}_i\Vert M_{root,i}\right)$$

(18)

where $G_i$ denotes the immutable governance record associated with the i-th behavioral baseline version. This record provides cryptographic evidence of when behavioral recalibration occurred, why it was initiated, and which behavioral baseline was subsequently adopted for operational monitoring.

Figure 15 illustrates the governance workflow linking behavioral baseline recalibration with immutable blockchain-assisted audit verification.

Figure 15. Cryptographic governance workflow for behavioral baseline recalibration and immutable audit versioning.

Whenever population-level behavioral drift exceeds the predefined supervisory threshold, the framework temporarily suspends employee-level adaptive anomaly prioritization, generates a new behavioral baseline, computes the corresponding Merkle root, constructs the governance record, protects the record using SHA-256 hashing, and appends the resulting cryptographic evidence to the blockchain-assisted audit log. Only after successful integrity verification does the framework resume ordinary ABAF monitoring using the newly established behavioral baseline.

Unlike the transaction-level audit records described in Section 4.8, which preserve immutable evidence of analytical outputs, the governance records document the evolution of the monitoring model itself. Consequently, historical analytical decisions remain reproducible because every transaction can be traced to the exact behavioral baseline version used during its original evaluation, even after multiple recalibration cycles.

This governance mechanism resolves the apparent tension between adaptive behavioral learning and immutable auditability. Behavioral models remain capable of adapting to evolving operational environments, while every recalibration event is permanently authenticated, versioned, and cryptographically linked to the corresponding behavioral baseline. The proposed blockchain-assisted audit layer therefore functions not only as a repository of analytical outputs but also as an immutable governance infrastructure that preserves the complete evolution history of behavioral baselines, thereby supporting transparent model evolution, regulatory accountability, and fully reproducible enterprise financial monitoring across successive recalibration cycles.

5. Discussion

The experimental results demonstrate that the proposed hybrid Blockchain–AI framework provides an integrated and operationally effective approach for intelligent financial monitoring within enterprise-oriented salary advance FinTech environments. By integrating behavioral drift modeling, the Behavioral Risk Deviation Index (BRDI), Adaptive Behavioral Anomaly Fusion (ABAF), explainable risk scoring, and blockchain-assisted audit verification, the framework addresses several important limitations commonly associated with conventional financial monitoring systems, including weak operational transparency, fragmented auditability, limited anomaly interpretability, and insufficient adaptability to evolving behavioral transaction patterns.

The proposed framework does not attempt to distinguish behavioral changes caused by individual opportunistic behavior from broader socio-economic or organizational factors such as payroll schedule modifications, seasonal financial demands, or changes in employee financial conditions. Instead, behavioral drift is interpreted as an operational indicator of changing transaction behavior requiring adaptive monitoring. Consequently, the framework supports prioritization of behaviorally unusual transactions rather than causal attribution of the underlying behavioral change.

The additional stress-testing experiments further demonstrate that the proposed framework remains operational when the assumption of localized behavioral drift is intentionally violated. Rather than interpreting simultaneous increases in employee-specific BRDI values as widespread individual anomalies, the supervisory monitoring mechanism identifies organization-wide behavioral shifts through the Population Drift Index (PDI) and initiates behavioral baseline recalibration before ordinary adaptive anomaly monitoring resumes. Consequently, the proposed framework explicitly distinguishes localized behavioral anomalies from population-level behavioral change at the governance level while preserving the adaptive behavior of the ABAF mechanism.

The proposed architecture intentionally separates adaptive anomaly estimation from explainable risk interpretation. While the anomaly fusion process dynamically adjusts the relative contribution of heterogeneous anomaly detectors according to behavioral conditions, the explainability layer operates on the final calibrated ensemble model. This architectural separation provides stable transaction-level explanations for operational decisions while preserving the adaptive behavior of the anomaly detection stage. Consequently, the proposed framework supports reproducible and auditable explanations despite the dynamic nature of the upstream anomaly fusion process.

One of the most important findings of the study is the effectiveness of integrating behavioral drift-aware anomaly assessment within a unified financial monitoring architecture. The proposed Behavioral Risk Deviation Index (BRDI) enables the framework to explicitly quantify deviations between current transaction behavior and historical behavioral patterns, while the Adaptive Behavioral Anomaly Fusion (ABAF) mechanism dynamically adjusts the contribution of statistical and reconstruction-based anomaly estimators according to behavioral risk conditions. The experimental results indicate that incorporating behavioral drift information substantially improves anomaly discrimination capability and enhances robustness under highly imbalanced and dynamically evolving financial transaction environments. This behavior can be explained by the fact that behavioral drift captures gradual changes in employee-specific transaction patterns that cannot be represented by static statistical features alone. Consequently, the adaptive fusion mechanism becomes more sensitive to behaviorally unusual salary advance activity while remaining less affected by legitimate operational variability.

The results further demonstrate that behavioral feature engineering and behavioral drift modeling provide complementary information beyond conventional transaction-level descriptors. Features related to transaction variability, temporal irregularities, rolling statistics, and behavioral entropy contributed to anomaly discrimination, while BRDI captured evolving behavioral instability relative to historical employee profiles. Together, these findings support the importance of explicitly modeling behavioral change for enterprise financial monitoring.

The explainable risk scoring analysis further highlights the practical importance of interpretable AI mechanisms within regulation-sensitive financial infrastructures. In many operational financial environments, anomaly detection systems must not only identify suspicious activities but also provide understandable analytical explanations supporting operational accountability and analyst trust. The integration of SHAP-based explainability mechanisms within the proposed framework enables transparent interpretation of transaction-level risk estimation outcomes and improves the operational usability of AI-assisted financial monitoring systems. Furthermore, the explainability analysis indicates that several transaction-level statistical features, particularly transaction variability and amount-related characteristics, contributed strongly to the final risk estimation. Although BRDI primarily operates within the adaptive anomaly fusion stage rather than as a direct input to the final ensemble classifier, behavioral drift information influences the anomaly scores subsequently incorporated into the overall monitoring framework. Consequently, the contribution of BRDI is reflected indirectly through the adaptive anomaly assessment process rather than through the feature importance rankings of the final predictive model. This finding suggests that behavioral context contributes complementary information beyond conventional transaction-level descriptors, enabling the framework to identify anomalies arising from evolving behavioral patterns rather than isolated financial characteristics.

An important contribution of the proposed framework is the integration of explainability directly within the operational anomaly detection pipeline rather than treating interpretability as an isolated postprocessing component. This design improves consistency between anomaly detection outputs, behavioral risk estimation, and operational auditability procedures while supporting more trustworthy and transparent financial monitoring workflows.

It should also be noted that BRDI is not intended to function as a conventional predictive feature within the final ensemble classifier. Instead, it operates as an adaptive control variable governing the relative weighting of the statistical and reconstruction-based anomaly detectors during the Behavioral Anomaly Fusion stage. Consequently, its contribution is structural rather than directly reflected in feature importance measures computed for the downstream classifier.

The blockchain-assisted audit verification layer additionally provides important operational advantages for enterprise-oriented FinTech infrastructures requiring strong transaction traceability, tamper-resistant monitoring, and trustworthy auditability. The experimental validation demonstrated that cryptographic integrity verification based on SHA-256 hashing and Merkle-root aggregation effectively preserves immutable operational transaction relationships and enables reliable detection of unauthorized transaction modifications. These characteristics are particularly important within enterprise financial systems operating under governance-oriented, compliance-sensitive, or audit-intensive operational conditions. This finding indicates that the primary contribution of the blockchain-assisted audit layer lies not in improving predictive performance but in strengthening audit transparency, transaction traceability, and post-event verification, thereby complementing rather than replacing AI-based anomaly detection.

The introduction of cryptographic governance for behavioral baseline recalibration further extends the role of the blockchain-assisted audit layer beyond transaction-level traceability. In addition to preserving immutable analytical outputs, the audit layer now maintains version-controlled records of behavioral baseline evolution, ensuring that every recalibration event is cryptographically authenticated, permanently recorded, and linked to the corresponding behavioral model version. This mechanism enables complete reconstruction of historical analytical decisions even after multiple baseline recalibration cycles while preserving end-to-end auditability.

The experimental analysis also demonstrated that the layered separation between AI-driven analytical intelligence and immutable cryptographic audit verification improves architectural flexibility and operational scalability. The analytical AI layer can continuously evolve through adaptive behavioral learning and anomaly detection optimization while the blockchain-assisted audit layer independently preserves operational consistency, transaction integrity, and immutable verification traceability.

Compared with conventional centralized monitoring infrastructures, the proposed framework combines adaptive anomaly detection, explainable risk scoring, immutable audit verification, and cryptographically governed behavioral baseline evolution within a unified enterprise monitoring architecture.

Although several conventional ensemble classifiers achieved slightly higher values for individual predictive metrics such as ROC-AUC or PR-AUC, the objective of the proposed framework extends beyond maximizing standalone classification performance. Moreover, direct numerical comparison with many studies reviewed in Section 2 is inherently limited because most existing work focuses on standalone fraud detection or credit-scoring models, whereas the proposed framework integrates behavioral drift modeling, adaptive anomaly fusion, explainable risk assessment, probability calibration, and audit-oriented verification within a unified enterprise monitoring architecture. Consequently, the proposed contribution should be interpreted as a comprehensive operational monitoring framework rather than as a standalone predictive classifier.

From a methodological perspective, the principal novelty of the proposed framework is not the individual anomaly detectors themselves but the Behavioral Drift-Aware Adaptive Anomaly Fusion mechanism. Specifically, the framework dynamically adjusts the relative contribution of statistical and reconstruction-based anomaly detection according to the Behavioral Risk Deviation Index, allowing the monitoring process to adapt to evolving employee behavior instead of relying on fixed anomaly fusion weights. Importantly, the proposed contribution lies in the adaptive interaction between behavioral state estimation and anomaly fusion rather than in the introduction of new standalone anomaly detection algorithms.

The quantitative improvement over conventional ensemble baselines in terms of F1-score is relatively modest. Therefore, the contribution of the proposed framework should not be interpreted as a substantial increase in predictive accuracy alone. Instead, its primary value lies in integrating behavioral drift modeling, adaptive anomaly fusion, explainable risk assessment, probability calibration, and audit-oriented integrity verification within a unified enterprise monitoring architecture. These capabilities extend beyond conventional ensemble classifiers and support practical operational monitoring requirements that are not reflected by individual classification metrics alone.

Despite the encouraging experimental results, several limitations of the proposed framework should be acknowledged.

First, the experimental evaluation was conducted using anonymized salary advance transaction data obtained from a single enterprise environment. Although the dataset reflects realistic operational monitoring conditions, additional validation across multiple organizations, industries, and financial domains would improve the generalizability of the proposed framework.

Second, although model robustness was assessed using stratified five-fold cross-validation together with bootstrap confidence intervals for the principal evaluation metrics, formal statistical significance tests (e.g., McNemar’s test or Wilcoxon signed-rank test) were not performed because the objective of this study was to evaluate the proposed integrated monitoring framework rather than conduct comparative classifier benchmarking.

Another limitation concerns the behavioral representation itself. The proposed behavioral drift model quantifies deviations relative to each employee’s historical behavioral profile but does not explicitly distinguish behavioral changes caused by individual opportunistic activity from those arising from broader organizational, seasonal, or socio-economic factors. Consequently, behavioral drift should be interpreted as an operational monitoring indicator rather than direct evidence of fraudulent behavior. Incorporating contextual organizational information, payroll-level indicators, or macroeconomic variables may further improve behavioral interpretation.

The proposed Adaptive Behavioral Anomaly Fusion mechanism also assumes that behavioral changes remain predominantly localized to individual employees or relatively small groups of transactions. During periods of widespread behavioral change affecting a substantial proportion of the monitored population, such as organizational policy changes or large-scale economic disruptions, the distinction between localized behavioral anomalies and population-level behavioral shifts may become less pronounced.

Although the proposed framework now incorporates supervisory detection of population-level behavioral drift and behavioral baseline recalibration, the current implementation employs a synthetic stress-testing scenario rather than real organization-wide behavioral events. Future research should therefore validate the proposed governance mechanism using longitudinal enterprise datasets containing naturally occurring policy changes, economic disruptions, or other large-scale behavioral shifts, and further investigate hierarchical behavioral modeling and contextual behavioral adaptation mechanisms.

In addition, BRDI was designed as an intermediate behavioral state representation for regulating adaptive anomaly fusion rather than as an independent predictive indicator. Although the experimental results demonstrate its usefulness within the proposed architecture, further validation using external enterprise datasets and alternative behavioral feature representations would provide additional evidence regarding its general applicability.

The blockchain-assisted audit layer was intentionally implemented using lightweight cryptographic integrity mechanisms rather than a fully decentralized public blockchain infrastructure, prioritizing enterprise scalability, computational efficiency, and practical deployment.

Finally, although the proposed explainability mechanism generates stable transaction-level explanations through the downstream ensemble classifier, its consistency under long-term behavioral evolution remains to be investigated.

Overall, the proposed framework is intended to complement rather than replace conventional predictive classifiers. Its principal contribution is the integration of behavioral drift modeling, adaptive anomaly fusion, explainable risk assessment, probability calibration, blockchain-assisted audit verification, and cryptographic governance of behavioral baseline evolution within a unified enterprise monitoring architecture for salary advance FinTech systems.

6. Conclusions

This study presented a Behavioral Drift-Aware Adaptive Anomaly Fusion (ABAF) framework for explainable operational risk monitoring in salary advance FinTech systems. The proposed framework integrates behavioral drift modeling, the Behavioral Risk Deviation Index (BRDI), adaptive anomaly fusion, explainable ensemble-based risk scoring, probability calibration, blockchain-assisted audit verification, and cryptographic governance of behavioral baseline recalibration within a unified enterprise monitoring architecture.

Unlike conventional financial anomaly detection approaches that primarily rely on static behavioral representations or fixed anomaly fusion strategies, the proposed framework explicitly models deviations between current and historical employee-specific transaction behavior and utilizes this behavioral state to adapt the relative contribution of complementary anomaly detection mechanisms. Rather than treating behavioral drift as direct evidence of fraudulent activity, the proposed approach interprets behavioral change as an operational monitoring signal that supports adaptive transaction prioritization while preserving explainability and auditability.

Experimental evaluation using 52,846 anonymized salary advance transactions demonstrated that the proposed framework provides robust anomaly detection performance under highly imbalanced operational conditions. The results further showed that incorporating behavioral drift information through BRDI improves adaptive anomaly fusion compared with fixed fusion strategies. The ablation study confirmed that BRDI and the Adaptive Behavioral Anomaly Fusion mechanism improve behavioral anomaly discrimination by adapting the monitoring process to evolving employee-specific transaction behavior.

An important contribution of this work lies in the architectural integration of adaptive anomaly monitoring with explainable AI. The proposed framework intentionally separates adaptive anomaly estimation from explainable risk interpretation. Behavioral adaptation is performed during anomaly fusion, whereas transaction-level explanations are generated by the final calibrated ensemble model. This separation enables stable, reproducible, and auditable explanations while preserving the adaptive behavior required for monitoring continuously evolving financial transaction patterns.

The blockchain-assisted audit layer further extends the framework by providing cryptographic integrity verification based on SHA-256 hashing and Merkle-root validation. Rather than improving predictive performance, this component strengthens operational traceability, tamper-resistant auditability, and post-event verification, thereby complementing the AI-based monitoring process within enterprise financial environments.

The proposed framework further extends blockchain-assisted auditability by introducing cryptographic governance of behavioral baseline recalibration. Whenever organization-wide behavioral drift is detected through the supervisory monitoring mechanism, behavioral baseline updates are versioned, cryptographically authenticated, and permanently linked to immutable governance records. This design enables adaptive behavioral learning while preserving complete traceability of model evolution and reproducibility of historical analytical decisions.

Although several conventional ensemble classifiers achieved comparable predictive performance, the principal contribution of the proposed framework is not the introduction of another standalone predictive model. Instead, this study contributes an integrated enterprise monitoring architecture combining behavioral drift modeling, adaptive anomaly fusion, explainable risk assessment, probability calibration, and audit-oriented verification.

Several limitations should be acknowledged. The framework was evaluated using anonymized salary advance transactions collected from a single enterprise environment, and additional multi-organization validation is required to assess its generalizability. Moreover, behavioral drift is modeled relative to employee-specific historical behavior and does not explicitly distinguish individual behavioral anomalies from broader organizational or socio-economic changes. Finally, although the proposed framework now incorporates supervisory detection of population-level behavioral drift through synthetic stress-testing, further validation using real organization-wide behavioral changes observed in longitudinal enterprise datasets remains necessary.

Future research will focus on validating the proposed framework across multiple enterprise datasets, evaluating the proposed supervisory population-level drift detection and cryptographic governance mechanisms using real longitudinal enterprise data, incorporating contextual organizational information into behavioral modeling, and extending the architecture to distributed enterprise monitoring environments.

Overall, this study demonstrates that behavioral drift-aware adaptive anomaly fusion can be effectively integrated with explainable AI, blockchain-assisted audit verification, supervisory population-level drift monitoring, and cryptographic governance of behavioral baseline recalibration within a unified enterprise monitoring architecture. Rather than proposing a standalone predictive model, the study contributes a practical framework for behavior-aware anomaly monitoring, interpretable operational risk assessment, and trustworthy audit support in salary advance FinTech systems.