| FWEA-01 |
OFAC person match (origin) |
Exact + fuzzy (Levenshtein <=2, phonetic Soundex) |
OFAC SDN + CSL |
CLEAR |
sha256:01of...f1i |
| FWEA-02 |
OFAC person match (counterparty) |
Exact + fuzzy + transliteration |
OFAC SDN + CSL + EU + UK |
CLEAR |
sha256:02of...f2i |
| FWEA-03 |
PEP screening - beneficial owners |
UBO graph traversal to depth 3 |
OpenSanctions PEP list |
CLEAR |
sha256:03pe...f3i |
| FWEA-04 |
Synthetic identity detection |
Document cross-reference + velocity modeling |
GLEIF + OpenCorporates + telco records |
CLEAR |
sha256:04sy...f4i |
| FWEA-05 |
Document deepfake detection |
Signature + metadata + font analysis |
JIL document integrity ML |
CLEAR |
sha256:05do...f5i |
| FWEA-06 |
AI voice deepfake at authorization |
Spectral + prosodic + behavioral analysis |
JIL voice auth ML |
CLEAR |
sha256:06ai...f6i |
| FWEA-07 |
Destination wallet SDN match |
O(1) hash-table lookup (<1ms) |
OFAC SDN + CSL + UK OFSI |
CLEAR |
sha256:07de...f7i |
| FWEA-55 |
Fraud ring graph analysis |
Community detection on entity graph |
JIL fraud-ring detector |
CLEAR |
sha256:55fr...f5m |
| FWEA-56 |
Typology library pattern match |
Published typology overlay (pig-butchering, APP, etc) |
JIL typology library v3 |
CLEAR |
sha256:56ty...f6m |
| FWEA-57 |
Cross-rail correlation |
Same entity on multiple rails |
JIL entity resolution |
CLEAR |
sha256:57cr...f7m |
| FWEA-58 |
FaaS (Fraud-as-a-Service) infrastructure |
Known FaaS C2 + tooling signature |
JIL FaaS intel |
CLEAR |
sha256:58fa...f8m |
| FWEA-59 |
FATF typology pattern match |
Graph-motif match across 30d window |
JIL L1 + Chainalysis clusters |
CLEAR |
sha256:59fa...f9c |
| FWEA-60 |
Egmont FIU intelligence overlay |
FIU-flagged entity check |
Egmont Group secure channel |
CLEAR |
sha256:60eg...f0c |
| FWEA-61 |
BIS CPMI payment system risk |
Payment corridor risk score |
BIS CPMI annual report data |
LOW |
sha256:61bi...f1c |
| FWEA-62 |
Cross-border velocity multi-jurisdiction |
Velocity across 3+ jurisdictions 7d |
JIL cross-border detector |
CLEAR |
sha256:62cr...f2c |
| FWEA-63 |
Sanctioned-jurisdiction hub routing |
Proximity to sanctioned corridor |
OFAC country list + corridor graph |
CLEAR |
sha256:63sa...f3c |
| FWEA-64 |
TBML with World Bank commodity prices |
Invoice-price variance vs market |
World Bank commodity index + WCO |
CLEAR |
sha256:64tb...f4c |
| FWEA-65 |
Pig butchering / romance-investment scam |
Behavior + destination + dialog ML |
JIL pig-butcher registry + NIST |
CLEAR |
sha256:65pi...f5e |
| FWEA-66 |
FaaS C2 infrastructure attribution |
Infrastructure overlap with known FaaS |
JIL FaaS infra graph |
CLEAR |
sha256:66fa...f6e |
| WIE-01 |
Destination wallet age |
Genesis-tx trace + funding attribution |
JIL L1 on-chain history |
847 days (LOW RISK) |
sha256:01de...w1w |
| WIE-02 |
Funding source attribution |
Recursive source-of-funds trace |
JIL attribution-evm + Chainalysis |
CLEAR |
sha256:02fu...w2w |
| WIE-03 |
First-block recency flag |
Age vs transaction volume ratio |
JIL L1 + chain-specific |
CLEAR |
sha256:03fi...w3w |
| WIE-04 |
Dormancy awakening signal |
Long-dormant -> sudden activity |
JIL dormancy tracker |
CLEAR |
sha256:04do...w4w |
| WIE-05 |
Dust attack detection |
Micro-tx flood pattern |
JIL dust detector |
CLEAR |
sha256:05du...w5w |
| WIE-06 |
Fresh-wallet-with-instant-activity |
Activity within 1h of creation |
JIL creation telemetry |
CLEAR |
sha256:06fr...w6w |
| WIE-07 |
Bulk wallet creation signal |
Sequential wallet creation cluster |
JIL creation graph |
CLEAR |
sha256:07bu...w7w |
| WIE-08 |
Contamination 2-hop weighted |
Graph traversal, decay-weighted exposure scoring |
JIL L1 + Chainalysis |
0.02% (CLEAR) |
sha256:08co...w8c |
| WIE-09 |
Direct darknet exposure |
0-hop match to known darknet wallets |
JIL known-bad registry |
CLEAR |
sha256:09di...w9c |
| WIE-10 |
Direct ransomware operator exposure |
0-hop match to ransomware wallets |
JIL ransomware intel (Conti/LockBit/BlackCat/Cl0p) |
CLEAR |
sha256:10di...w0c |
| WIE-11 |
Mixer/tumbler exposure |
Exposure to Tornado Cash, Blender.io, ChipMixer, Sinbad |
JIL mixer registry |
CLEAR |
sha256:11mi...w1c |
| WIE-12 |
Exchange-hack cluster exposure |
Mt. Gox, Bitfinex, FTX, KuCoin hack wallets |
JIL hack attribution |
CLEAR |
sha256:12ex...w2c |
| WIE-13 |
Known-bad cluster exposure (full) |
0/1/2/3-hop lookup against all known-bad |
JIL known-bad registry |
CLEAR |
sha256:13kn...w3c |
| WIE-14 |
State-actor cluster exposure |
Lazarus Group, APT38, Russian ransomware |
JIL state-actor attribution |
CLEAR |
sha256:14st...w4c |
| WIE-15 |
Transaction cadence anomaly |
Inter-arrival time distribution |
JIL L1 cadence analyzer |
CLEAR |
sha256:15tr...w5v |
| WIE-16 |
Amount distribution outlier |
Distribution vs 90d self-baseline |
JIL amount analyzer |
CLEAR |
sha256:16am...w6v |
| WIE-17 |
Bot activity signature |
Automated tx signing pattern |
JIL bot detector |
CLEAR |
sha256:17bo...w7v |
| WIE-18 |
Burst-and-drain pattern |
High inbound then full drain |
JIL burst detector |
CLEAR |
sha256:18bu...w8v |
| WIE-19 |
Round-amount trading |
Round-number frequency outlier |
JIL amount analyzer |
CLEAR |
sha256:19ro...w9v |
| WIE-20 |
Fragmentation pattern |
Tx split into sub-threshold batches |
JIL fragmentation detector |
CLEAR |
sha256:20fr...w0v |
| WIE-21 |
Cross-chain arbitrage signature |
Arbitrage-like paired tx across chains |
JIL cross-chain detector |
CLEAR |
sha256:21cr...w1v |
| WIE-22 |
Protocol whitelist match |
Interacted protocols in whitelist |
JIL DeFi whitelist |
94/100 (HIGH TRUST) |
sha256:22pr...w2d |
| WIE-23 |
LP quality score |
Uniswap / Balancer pool quality |
JIL DeFi attestation ledger |
HIGH |
sha256:23lp...w3d |
| WIE-24 |
Rug-pull heuristic |
Known rug-pull cluster exposure |
JIL rug-pull registry |
CLEAR |
sha256:24ru...w4d |
| WIE-25 |
Yield-farming exposure |
Yield-protocol interaction + risk tier |
JIL yield-farm classifier |
LOW |
sha256:25yi...w5d |
| WIE-26 |
Flash-loan anomaly |
Flash-loan pattern in history |
JIL flash-loan detector |
CLEAR |
sha256:26fl...w6d |
| WIE-27 |
Bridge-exploit exposure |
Known bridge-exploit interaction |
JIL bridge-exploit registry |
CLEAR |
sha256:27br...w7d |
| WIE-28 |
Governance manipulation signal |
Flash-loan governance attack pattern |
JIL governance-attack detector |
CLEAR |
sha256:28go...w8d |
| WIE-29 |
Cross-wallet clustering |
JIL attribution engine (BTC/EVM/SOL/TRX) |
JIL attribution engines |
No discrepancy |
sha256:29cr...w9h |
| WIE-30 |
Change-address heuristic (BTC) |
Multi-input + change detection |
JIL attribution-btc |
CLEAR |
sha256:30ch...w0h |
| WIE-31 |
Common-ownership heuristic |
Co-spending patterns across wallets |
JIL attribution-btc/evm |
CLEAR |
sha256:31co...w1h |
| WIE-32 |
Bridge-correlation clustering |
Cross-chain bridge traffic as identity |
JIL attribution-bridges |
CLEAR |
sha256:32br...w2h |
| WIE-33 |
CEX-withdrawal correlation |
CEX-withdrawal timing + amount match |
JIL CEX attribution |
CLEAR |
sha256:33ce...w3h |
| WIE-34 |
Off-chain-linked wallet |
Corporate entity + wallet linkage via OpenCorporates |
OpenCorporates + JIL entity graph |
CLEAR |
sha256:34of...w4h |
| WIE-35 |
Real-estate linked wallet |
Property-purchase blockchain linkage |
ATTOM Property + JIL entity graph |
CLEAR |
sha256:35re...w5h |
| WIE-36 |
Jurisdictional fit (corridor) |
Counterparty jurisdiction vs origin corridor |
GLEIF + OpenCorporates |
PASS (US-SG corridor compliant) |
sha256:36ju...w6r |
| WIE-37 |
Sanctions-list proximity |
Distance to any sanctioned wallet in graph |
OFAC + EU + UK SDN + JIL L1 |
> 4 hops (CLEAR) |
sha256:37sa...w7r |
| WIE-38 |
PEP overlap (counterparty UBO) |
UBO graph overlap with PEP list |
OpenSanctions PEP |
CLEAR |
sha256:38pe...w8r |
| WIE-39 |
Adverse media flag |
Counterparty name in adverse-media feed |
OpenSanctions media + Dow Jones |
CLEAR |
sha256:39ad...w9r |
| WIE-40 |
Taint-free proof |
Cumulative contamination score under 1% |
JIL taint calculator |
0.02% (PASS) |
sha256:40ta...w0r |
| WIE-41 |
MiCA stablecoin eligibility |
Token MiCA-registered flag |
EBA MiCA registry |
PASS |
sha256:41mi...w1r |
| WIE-42 |
Travel-rule data completeness |
Originator+beneficiary data fields populated |
IVMS 101 validator |
PASS |
sha256:42tr...w2r |