Bank-Fingerprint UBO Chain Detection via Recursive Entity Resolution

Executive Summary

JIL Sovereign's bank-fingerprint UBO chain detection system identifies coordinated-entity fraud rings by combining bank-account fingerprints with recursive ultimate-beneficial-owner (UBO) ownership-graph traversal. A bank fingerprint is a normalized tuple - routing or SWIFT identifier, account-prefix hash, normalized signatory name, and normalized signatory address - computed automatically at claim or transaction ingestion, not as a separate investigative step.

A recursive common-table-expression query then traverses an ownership-graph database keyed by entity, enumerating every entity reachable from a target entity through ownership edges up to a configurable depth, and intersecting the fingerprint sets of the target and each reachable entity. Findings surface the count of shared fingerprints, the ownership-chain depth at which sharing occurred, and a graph rendering for investigator review.

Problem Statement

Healthcare fraud, financial-institution fraud, and trade-finance fraud frequently involve rings of nominally-distinct legal entities that share financial infrastructure - bank accounts, signatories, addresses - while presenting as independent operators on paper. Detecting them requires correlating claim or transaction data with ownership-graph data; production systems today do one or the other, rarely both, and essentially never through a shared financial-infrastructure fingerprint.

Why Existing Solutions Are Insufficient

• Public UBO/ownership registries (OpenCorporates, GLEIF, EU/UK beneficial-ownership filings): provide ownership chains but do not by themselves correlate to claim-level financial infrastructure.
• Claim-fraud detection systems (healthcare prepayment review, trade-finance verification): examine individual claims for coding or amount anomalies but do not traverse ownership graphs to detect cross-entity coordination.
• Generic entity-resolution / MDM software: performs fuzzy name/address matching within a single dataset but has no recursive ownership-graph traversal or fingerprint-intersection ranking logic.

Technical Architecture

Fingerprint Computation

The canonicalized tuple is hashed with SHA-256 into a 32-byte fingerprint_hash, stored alongside every ingested claim or transaction in a table keyed (entity_id, fingerprint_hash, source_record_id, observed_at) with B-tree indexes on both entity_id and fingerprint_hash.

Recursive Ownership-Graph Traversal

The UBO graph stores directed edges (parent_entity_id, child_entity_id, ownership_percent, source_jurisdiction) populated from public registries. Given a target entity, a recursive CTE enumerates all entities reachable through ownership edges up to a configurable maximum depth (defaults to 5):

WITH RECURSIVE reachable AS (
  SELECT child_entity_id AS entity_id, 1 AS depth FROM ownership WHERE parent_entity_id = $target
  UNION ALL
  SELECT o.child_entity_id, r.depth + 1 FROM ownership o JOIN reachable r ON o.parent_entity_id = r.entity_id
  WHERE r.depth < $max_depth
)
SELECT a.entity_id, b.entity_id, COUNT(DISTINCT a.fingerprint_hash) AS shared
FROM fingerprints a JOIN fingerprints b ON a.fingerprint_hash = b.fingerprint_hash
WHERE a.entity_id = $target AND b.entity_id IN (SELECT entity_id FROM reachable)
GROUP BY a.entity_id, b.entity_id
HAVING COUNT(DISTINCT a.fingerprint_hash) >= 1

Findings are produced for every pair with non-zero intersection, ranked by shared-fingerprint count (descending) and ownership-chain depth (ascending); pairs sharing two or more fingerprints are flagged high-priority for a human investigator review queue. A visualization renderer draws entities as nodes, ownership edges as solid arrows labeled with percent, and shared fingerprints as dashed connectors labeled by fingerprint type.

Cluster Detection & Multi-Modal Extension

A fingerprint-clustering module runs union-find over the fingerprint-sharing relation independent of any single named target entity, surfacing rings of entities that transitively share two or more fingerprints - useful when investigators do not yet have a starting suspect. In a further embodiment, fingerprint computation extends beyond bank-account data to:

• Address-block fingerprinting - geographic clustering of premises within a small radius.
• Shared-domain-registrant fingerprinting - WHOIS registrant correlation across entity web presences.
• Shared-phone-number fingerprinting - contact-number reuse across nominally distinct entities.

Multi-modal fingerprinting increases ring-detection sensitivity beyond what any single fingerprint dimension can surface alone, and findings from every fingerprint class feed the same intersection-and-ranking logic described above.

Prior Art Differentiation

Patent Claim