Crypto exchanges · Specified

The decision: Onboard or refuse. Release funds or hold.

The same bank letter, three account holders, eleven days.

An institutional onboarding pack: proof of address, a bank letter, a source of wealth declaration, corporate structure and beneficial ownership. Individually each document passes. The pack has been assembled to order, and the evidence for that is in the files, not in the narrative.

This is not a customer case study

There is no production tenant and no paying customer. Every document, finding and verdict on this page is synthetic, written to show what the forensic core examines and what a cited verdict looks like. No accuracy or detection figure appears here, because no pilot has produced one under a methodology we would publish beside it. The rule set for this sector is specified, not encoded. The forensic findings below run on any document bundle today; the sector rules do not exist yet.

What arrives

The bundle as it lands, before anybody has read it.

Proof of addressUtility bill, image
Bank letter1 page, PDF, on letterhead
Source of funds declaration2 pages, signed
Corporate structure4 pages, chart and register extracts
Beneficial ownership1 page, declared
Identity documents3 documents, images

What gets examined

The forensic core runs on every document in the bundle regardless of sector. None of these questions changes when the industry changes.

Document lineage Fabrication detection Template comparison Image forensics Sender authentication Registry resolution Cross-file reuse Entity resolution Cross-document reconciliation

What comes back

Every finding carries at least two anchors drawn from at least two separate documents, and the benign explanation that would account for it. A pattern appearing once in one place is not reported at all.

This bank letter has appeared on two other onboarding files this month Cross-file reuse

Identical template, identical layout offsets, identical embedded object structure, with the account holder name, the account number and the balance substituted. Three files, three unrelated applicants, eleven days.

Anchored to
  • Bank letter, embedded object structure and layout fingerprint
  • Onboarding files 2026-0431 and 2026-0447, same fingerprint

The benign explanation: A bank issues letters from one template, so a shared fingerprint is expected. What is not expected is the substitution pattern, which is why the finding rests on both and not on the template alone.

The utility bill address block shows resampling inconsistent with the page Image forensics

The address block carries compression characteristics and a noise profile that do not match the surrounding page, consistent with that region having been replaced and the document re-flattened.

Anchored to
  • Proof of address, address block region, compression and noise analysis
  • Proof of address, remainder of page, baseline profile

The benign explanation: Redaction, a scan of a scan, or a photograph of a screen can each produce regional inconsistency without any intent to deceive.

A declared beneficial owner is an entity dissolved in its home register Registry resolution

One of the three declared owners resolves to a corporate entity whose status in the register of its stated jurisdiction is dissolved, with an effective date preceding the declaration. The natural persons behind it are not named anywhere in the pack.

Anchored to
  • Beneficial ownership declaration, owner 2, entity identifier
  • Corporate structure chart, page 3, same identifier

The benign explanation: Registers lag, and a dissolution can be administrative and later reversed. It is the absence of any natural person behind the entity that makes it worth a look.

The source of wealth narrative is supported by no document in the pack Sufficiency

The declaration attributes the funds to the sale of a business. No sale agreement, no completion statement, no tax record and no corporate filing evidencing the disposal appears anywhere in the bundle.

Anchored to
  • Source of funds declaration, page 1, stated origin
  • Bundle manifest, complete document inventory

The benign explanation: The supporting material may simply not have been requested yet. This finding is as much a gap in the request as a gap in the response.

The verdict

ESCALATE

Four findings, each anchored twice, spanning reuse, image integrity, registry status and evidential sufficiency. The account is not refused and no person is scored. The file goes to a compliance officer with the reasons attached, ready for a regulator to read.

The reuse finding is the one that does not exist in a single-institution control. A document that has been seen on another platform’s file this month is the strongest single signal available in this sector, and it only exists if the examination spans institutions rather than files.

What it did not do

The same four constraints apply in every sector, and they are enforced in code rather than in policy.

No adverse decision

Nothing was declined, refused, held or approved by the platform. A person decides, on the record, with the reasoning in front of them.

Every sector

No score

No risk number, no ranking, no composite figure. The only number attached to a person is how many independent documents corroborate a fact about them.

Nowhere in the product

No single-source assertion

Two anchors from two documents, or the finding is not reported. This is the largest source of false positives in the category and the platform refuses to generate them.

Enforced at registration

No protected attributes

A detector referencing a protected attribute fails registration and the platform will not start. It is a structural guarantee rather than a policy.

Throws on load

How this gets tested on your own files

Hand us two hundred closed files. Settled claims, funded loans, granted applications, paid invoices, onboarded accounts. We examine them and show you the documents that lied, against outcomes you already know. It is the only honest way to evaluate this category, and it is the same motion in every sector on this page.

The other sectors

Only insurance is built. Every other sector is specified rather than shipped: the forensic core runs on any bundle today, and no rule set outside insurance has been encoded. [email protected]