| FWEA-01 |
OFAC person match (origin) |
Exact + fuzzy (Levenshtein <=2, phonetic Soundex) |
OFAC SDN + CSL |
CLEAR |
sha256:01of...f1i |
| FWEA-02 |
OFAC person match (counterparty) |
Exact + fuzzy + transliteration |
OFAC SDN + CSL + EU + UK |
CLEAR |
sha256:02of...f2i |
| FWEA-03 |
PEP screening - beneficial owners |
UBO graph traversal to depth 3 |
OpenSanctions PEP list |
CLEAR |
sha256:03pe...f3i |
| FWEA-04 |
Synthetic identity detection |
Document cross-reference + velocity modeling |
GLEIF + OpenCorporates + telco records |
CLEAR |
sha256:04sy...f4i |
| FWEA-05 |
Document deepfake detection |
Signature + metadata + font analysis |
JIL document integrity ML |
CLEAR |
sha256:05do...f5i |
| FWEA-06 |
AI voice deepfake at authorization |
Spectral + prosodic + behavioral analysis |
JIL voice auth ML |
CLEAR |
sha256:06ai...f6i |
| FWEA-07 |
Destination wallet SDN match |
O(1) hash-table lookup (<1ms) |
OFAC SDN + CSL + UK OFSI |
CLEAR |
sha256:07de...f7i |
| FWEA-08 |
Business Email Compromise (BEC) pattern |
Domain similarity + content ML classifier |
JIL BEC detector + OpenAI moderation |
CLEAR |
sha256:08bu...f8p |
| FWEA-09 |
Invoice fraud detection |
Invoice fingerprinting + duplicate detection |
JIL invoice graph |
CLEAR |
sha256:09in...f9p |
| FWEA-11 |
Authorized Push Payment (APP) scam |
Behavioral deviation + destination risk |
JIL APP detector |
CLEAR |
sha256:11au...f1p |
| FWEA-12 |
Wire anomaly detection |
Z-score vs entity baseline (90d window) |
Custodian feed + JIL baseline |
CLEAR |
sha256:12wi...f2p |
| FWEA-13 |
SEPA APP fraud pattern (EU) |
SEPA rail-specific heuristics |
EBA SEPA registry + JIL detector |
CLEAR |
sha256:13se...f3p |
| FWEA-14 |
UK FPS Payment System Regulator (PSR) profile |
FPS reimbursement-risk scoring |
UK FPS + PSR guidance |
CLEAR |
sha256:14uk...f4p |
| FWEA-15 |
PIX fraud typology (Brazil) |
PIX chain-of-claim verification |
BCB PIX registry |
CLEAR |
sha256:15pi...f5p |
| FWEA-16 |
UPI fraud typology (India) |
UPI VPA collision + spoof detection |
NPCI UPI registry |
CLEAR |
sha256:16up...f6p |
| FWEA-17 |
SWIFT gpi chain substitution |
MT103 hop-by-hop integrity check |
SWIFT gpi tracker |
CLEAR |
sha256:17sw...f7p |
| FWEA-18 |
CIPS sanctioned-entity routing |
CIPS routing graph + sanctions overlay |
PBoC CIPS + OFAC overlay |
CLEAR |
sha256:18ci...f8p |
| FWEA-19 |
NPP PayID integrity (Australia) |
PayID binding verification |
AusPayNet NPP |
CLEAR |
sha256:19np...f9p |
| FWEA-22 |
Cryptocurrency off-ramp anomaly |
Off-ramp velocity vs historical |
Chainalysis + JIL off-ramp registry |
CLEAR |
sha256:22cr...f2p |
| FWEA-23 |
Check kite / float fraud |
Inter-account timing graph |
JIL check clearance timing |
CLEAR |
sha256:23ch...f3p |
| FWEA-24 |
Settlement instruction integrity |
IBAN MOD-97 + BIC ISO 9362 + endpoint attestation |
JIL L1 settlement path |
PASS |
sha256:24se...f4p |
| FWEA-25 |
OFAC country-level sanctions |
Jurisdiction routing check (IR, KP, SY, CU, RU-partial) |
OFAC country list |
CLEAR |
sha256:25of...f5r |
| FWEA-26 |
EU MiCA stablecoin classification |
Token symbol + issuer + whitelist |
EBA regulated tokens list |
PASS |
sha256:26eu...f6r |
| FWEA-27 |
EU DORA operational resilience |
ICT risk attestation presence |
EBA DORA registry |
PASS |
sha256:27eu...f7r |
| FWEA-28 |
UK FCA authorization status |
FCA register lookup + passport check |
FCA Register |
PASS |
sha256:28uk...f8r |
| FWEA-29 |
FATF International Travel Rule (>$3K) |
Originator / beneficiary data completeness |
FATF Travel Rule Protocol + IVMS 101 |
PASS |
sha256:29fa...f9r |
| FWEA-30 |
CBDC attestation (eCNY / DEUR / mBridge) |
CBDC issuer + compliance-envelope check |
BIS mBridge + PBoC eCNY + ECB DEUR |
N/A |
sha256:30cb...f0r |
| FWEA-31 |
NYDFS Part 500 applicability |
Counterparty NYDFS-regulated flag |
NYDFS covered entity list |
PASS |
sha256:31ny...f1r |
| FWEA-32 |
SEC Reg S / Reg D (if applicable) |
Investor accreditation + jurisdiction |
SEC filings + investor attestation |
N/A |
sha256:32se...f2r |
| FWEA-33 |
MAS Singapore DPT Act applicability |
Singapore counterparty check |
MAS DPT licensee list |
PASS |
sha256:33ma...f3r |
| FWEA-34 |
VARA UAE crypto licensing |
UAE counterparty license lookup |
VARA licensee registry |
PASS |
sha256:34va...f4r |
| FWEA-35 |
State MTL jurisdiction check |
US state-by-state money transmitter overlay |
NMLS MT licensing database |
PASS |
sha256:35st...f5r |
| FWEA-36 |
Velocity anomaly (origin 48h) |
Rolling z-score vs 90d baseline |
JIL L1 + custodian feed |
PASS (z=0.84) |
sha256:36ve...f6t |
| FWEA-37 |
Mule account scoring |
Inbound-outbound timing + network centrality |
JIL mule detector |
CLEAR |
sha256:37mu...f7t |
| FWEA-38 |
Smurfing / structuring pattern |
Sub-threshold frequency + 24h rollup |
JIL structuring detector |
CLEAR |
sha256:38sm...f8t |
| FWEA-39 |
Geographic anomaly |
Origin-destination distance vs entity norm |
JIL geo baseline |
CLEAR |
sha256:39ge...f9t |
| FWEA-42 |
Night / off-hours activity |
Time-of-day distribution outlier |
JIL temporal baseline |
CLEAR |
sha256:42ni...f2t |
| FWEA-43 |
Routing change detection (<72h) |
Last-minute routing delta alert |
Custodian instruction log |
CLEAR |
sha256:43ro...f3s |
| FWEA-44 |
Account-number change alert |
Counterparty account history vs current |
Custodian counterparty ledger |
CLEAR |
sha256:44ac...f4s |
| FWEA-45 |
Instruction provenance attestation |
Signed chain from originator |
JIL instruction attestation |
PASS |
sha256:45in...f5s |
| FWEA-46 |
IBAN integrity (MOD-97) |
Checksum + country length validation |
ISO 13616 IBAN registry |
PASS |
sha256:46ib...f6s |
| FWEA-47 |
Correspondent chain hop anomaly |
Hop-count + jurisdiction diversity |
SWIFT gpi trace |
CLEAR |
sha256:47co...f7s |
| FWEA-49 |
Endpoint binding attestation |
Destination wallet bound to counterparty identity |
JIL endpoint-binding registry |
PASS |
sha256:49en...f9s |
| FWEA-55 |
Fraud ring graph analysis |
Community detection on entity graph |
JIL fraud-ring detector |
CLEAR |
sha256:55fr...f5m |
| FWEA-56 |
Typology library pattern match |
Published typology overlay (pig-butchering, APP, etc) |
JIL typology library v3 |
CLEAR |
sha256:56ty...f6m |
| FWEA-57 |
Cross-rail correlation |
Same entity on multiple rails |
JIL entity resolution |
CLEAR |
sha256:57cr...f7m |
| FWEA-58 |
FaaS (Fraud-as-a-Service) infrastructure |
Known FaaS C2 + tooling signature |
JIL FaaS intel |
CLEAR |
sha256:58fa...f8m |
| FWEA-59 |
FATF typology pattern match |
Graph-motif match across 30d window |
JIL L1 + Chainalysis clusters |
CLEAR |
sha256:59fa...f9c |
| FWEA-60 |
Egmont FIU intelligence overlay |
FIU-flagged entity check |
Egmont Group secure channel |
CLEAR |
sha256:60eg...f0c |
| FWEA-61 |
BIS CPMI payment system risk |
Payment corridor risk score |
BIS CPMI annual report data |
LOW |
sha256:61bi...f1c |
| FWEA-62 |
Cross-border velocity multi-jurisdiction |
Velocity across 3+ jurisdictions 7d |
JIL cross-border detector |
CLEAR |
sha256:62cr...f2c |
| FWEA-63 |
Sanctioned-jurisdiction hub routing |
Proximity to sanctioned corridor |
OFAC country list + corridor graph |
CLEAR |
sha256:63sa...f3c |
| FWEA-64 |
TBML with World Bank commodity prices |
Invoice-price variance vs market |
World Bank commodity index + WCO |
CLEAR |
sha256:64tb...f4c |
| FWEA-65 |
Pig butchering / romance-investment scam |
Behavior + destination + dialog ML |
JIL pig-butcher registry + NIST |
CLEAR |
sha256:65pi...f5e |
| FWEA-66 |
FaaS C2 infrastructure attribution |
Infrastructure overlap with known FaaS |
JIL FaaS infra graph |
CLEAR |
sha256:66fa...f6e |
| FWEA-67 |
ZKP post-settlement attestation |
Zero-knowledge proof of compliant state |
JIL ZKP prover |
PASS |
sha256:67zk...f7c |
| FWEA-68 |
Adversarial ML drift detection |
Model drift vs golden baseline |
JIL ML governance |
CLEAR |
sha256:68ad...f8c |
| FWEA-69 |
HNDL quantum-safe TLS verification |
Dilithium + X25519 handshake verified |
JIL TLS attestation |
PASS |
sha256:69hn...f9c |
| WIE-01 |
Destination wallet age |
Genesis-tx trace + funding attribution |
JIL L1 on-chain history |
847 days (LOW RISK) |
sha256:01de...w1w |
| WIE-02 |
Funding source attribution |
Recursive source-of-funds trace |
JIL attribution-evm + Chainalysis |
CLEAR |
sha256:02fu...w2w |
| WIE-03 |
First-block recency flag |
Age vs transaction volume ratio |
JIL L1 + chain-specific |
CLEAR |
sha256:03fi...w3w |
| WIE-04 |
Dormancy awakening signal |
Long-dormant -> sudden activity |
JIL dormancy tracker |
CLEAR |
sha256:04do...w4w |
| WIE-05 |
Dust attack detection |
Micro-tx flood pattern |
JIL dust detector |
CLEAR |
sha256:05du...w5w |
| WIE-06 |
Fresh-wallet-with-instant-activity |
Activity within 1h of creation |
JIL creation telemetry |
CLEAR |
sha256:06fr...w6w |
| WIE-07 |
Bulk wallet creation signal |
Sequential wallet creation cluster |
JIL creation graph |
CLEAR |
sha256:07bu...w7w |
| WIE-08 |
Contamination 2-hop weighted |
Graph traversal, decay-weighted exposure scoring |
JIL L1 + Chainalysis |
0.02% (CLEAR) |
sha256:08co...w8c |
| WIE-09 |
Direct darknet exposure |
0-hop match to known darknet wallets |
JIL known-bad registry |
CLEAR |
sha256:09di...w9c |
| WIE-10 |
Direct ransomware operator exposure |
0-hop match to ransomware wallets |
JIL ransomware intel (Conti/LockBit/BlackCat/Cl0p) |
CLEAR |
sha256:10di...w0c |
| WIE-11 |
Mixer/tumbler exposure |
Exposure to Tornado Cash, Blender.io, ChipMixer, Sinbad |
JIL mixer registry |
CLEAR |
sha256:11mi...w1c |
| WIE-12 |
Exchange-hack cluster exposure |
Mt. Gox, Bitfinex, FTX, KuCoin hack wallets |
JIL hack attribution |
CLEAR |
sha256:12ex...w2c |
| WIE-13 |
Known-bad cluster exposure (full) |
0/1/2/3-hop lookup against all known-bad |
JIL known-bad registry |
CLEAR |
sha256:13kn...w3c |
| WIE-14 |
State-actor cluster exposure |
Lazarus Group, APT38, Russian ransomware |
JIL state-actor attribution |
CLEAR |
sha256:14st...w4c |
| WIE-15 |
Transaction cadence anomaly |
Inter-arrival time distribution |
JIL L1 cadence analyzer |
CLEAR |
sha256:15tr...w5v |
| WIE-16 |
Amount distribution outlier |
Distribution vs 90d self-baseline |
JIL amount analyzer |
CLEAR |
sha256:16am...w6v |
| WIE-17 |
Bot activity signature |
Automated tx signing pattern |
JIL bot detector |
CLEAR |
sha256:17bo...w7v |
| WIE-18 |
Burst-and-drain pattern |
High inbound then full drain |
JIL burst detector |
CLEAR |
sha256:18bu...w8v |
| WIE-19 |
Round-amount trading |
Round-number frequency outlier |
JIL amount analyzer |
CLEAR |
sha256:19ro...w9v |
| WIE-20 |
Fragmentation pattern |
Tx split into sub-threshold batches |
JIL fragmentation detector |
CLEAR |
sha256:20fr...w0v |
| WIE-21 |
Cross-chain arbitrage signature |
Arbitrage-like paired tx across chains |
JIL cross-chain detector |
CLEAR |
sha256:21cr...w1v |
| WIE-22 |
Protocol whitelist match |
Interacted protocols in whitelist |
JIL DeFi whitelist |
94/100 (HIGH TRUST) |
sha256:22pr...w2d |
| WIE-23 |
LP quality score |
Uniswap / Balancer pool quality |
JIL DeFi attestation ledger |
HIGH |
sha256:23lp...w3d |
| WIE-24 |
Rug-pull heuristic |
Known rug-pull cluster exposure |
JIL rug-pull registry |
CLEAR |
sha256:24ru...w4d |
| WIE-25 |
Yield-farming exposure |
Yield-protocol interaction + risk tier |
JIL yield-farm classifier |
LOW |
sha256:25yi...w5d |
| WIE-26 |
Flash-loan anomaly |
Flash-loan pattern in history |
JIL flash-loan detector |
CLEAR |
sha256:26fl...w6d |
| WIE-27 |
Bridge-exploit exposure |
Known bridge-exploit interaction |
JIL bridge-exploit registry |
CLEAR |
sha256:27br...w7d |
| WIE-28 |
Governance manipulation signal |
Flash-loan governance attack pattern |
JIL governance-attack detector |
CLEAR |
sha256:28go...w8d |
| WIE-29 |
Cross-wallet clustering |
JIL attribution engine (BTC/EVM/SOL/TRX) |
JIL attribution engines |
No discrepancy |
sha256:29cr...w9h |
| WIE-30 |
Change-address heuristic (BTC) |
Multi-input + change detection |
JIL attribution-btc |
CLEAR |
sha256:30ch...w0h |
| WIE-31 |
Common-ownership heuristic |
Co-spending patterns across wallets |
JIL attribution-btc/evm |
CLEAR |
sha256:31co...w1h |
| WIE-32 |
Bridge-correlation clustering |
Cross-chain bridge traffic as identity |
JIL attribution-bridges |
CLEAR |
sha256:32br...w2h |
| WIE-33 |
CEX-withdrawal correlation |
CEX-withdrawal timing + amount match |
JIL CEX attribution |
CLEAR |
sha256:33ce...w3h |
| WIE-34 |
Off-chain-linked wallet |
Corporate entity + wallet linkage via OpenCorporates |
OpenCorporates + JIL entity graph |
CLEAR |
sha256:34of...w4h |
| WIE-35 |
Real-estate linked wallet |
Property-purchase blockchain linkage |
ATTOM Property + JIL entity graph |
CLEAR |
sha256:35re...w5h |
| WIE-36 |
Jurisdictional fit (corridor) |
Counterparty jurisdiction vs origin corridor |
GLEIF + OpenCorporates |
PASS (US-SG corridor compliant) |
sha256:36ju...w6r |
| WIE-37 |
Sanctions-list proximity |
Distance to any sanctioned wallet in graph |
OFAC + EU + UK SDN + JIL L1 |
> 4 hops (CLEAR) |
sha256:37sa...w7r |
| WIE-38 |
PEP overlap (counterparty UBO) |
UBO graph overlap with PEP list |
OpenSanctions PEP |
CLEAR |
sha256:38pe...w8r |
| WIE-39 |
Adverse media flag |
Counterparty name in adverse-media feed |
OpenSanctions media + Dow Jones |
CLEAR |
sha256:39ad...w9r |
| WIE-40 |
Taint-free proof |
Cumulative contamination score under 1% |
JIL taint calculator |
0.02% (PASS) |
sha256:40ta...w0r |
| WIE-41 |
MiCA stablecoin eligibility |
Token MiCA-registered flag |
EBA MiCA registry |
PASS |
sha256:41mi...w1r |
| WIE-42 |
Travel-rule data completeness |
Originator+beneficiary data fields populated |
IVMS 101 validator |
PASS |
sha256:42tr...w2r |