FRIS — Forensic & Regulatory Intelligence Suite

01The problem

Sanctions designations and AML obligations attach to named parties — but illicit value rarely stays with a named party. It moves through nominees, layered corporate ownership, related vendors and, increasingly, crypto peel chains, so a screening tool that answers “hit / no hit” against a list misses the exposure sitting two ownership hops away. The regulated firm feels this as three distinct pains: alerts that arrive with no tracing context; investigation tooling fragmented across screening, adverse media, graph analysis and recovery; and, worst of the three, financial evidence that does not reconcile exactly and therefore will not survive a regulator, an auditor or opposing counsel. My LL.M. dissertation on economic warfare examined the legal side of this gap: regimes that reach the principal but not the proxy. FRIS is the operational side of the same argument.

02What I built

FRIS is roughly 20,000 lines of vanilla JavaScript — no framework, and in the browser build no network — behind a single investigative interface: 23 pure analysis engines spanning sanctions & AML screening with adverse-media, beneficial-ownership and asset-tracing graphs, deterministic crypto peel-chain simulation, country and vendor risk, transaction surveillance and monitoring, onboarding and typology tooling, enforcement and GRC views, and an insolvency liquidation waterfall.

• Money is handled as BigInt, so every trace reconciles exactly: initial = residual + peeled + fees, with no floating-point drift.
• A fetch-shim lets the identical UI run against a Node server or a fully in-memory dataset — the browser build answers its own API calls locally.
• A headless self-verification harness renders all 18 views and runs the 8 critical workflows before release; the latest run passes 18/18 and 8/8.
• The Regulatory Horizon module is built on 47 real, publicly-sourced instruments, each linked to its official source — kept strictly separate from the synthetic case data.

03Three decisions that carry the legal judgement

Three design decisions carry the legal judgement. First, the primary object is the graph, not the name: because evasion is organised through ownership and control structures, beneficial-ownership edges and asset-tracing paths are first-class citizens, and screening results are read in that structural context — which is how an investigator gets from an alert to a defensible suspicion. Second, the peel-chain engine is deterministic: a financial-crime finding has to be explainable and reproducible on demand, so FRIS simulates and traces value movements with exact arithmetic rather than scoring them with an opaque model — a trace that cannot be re-run identically is an exhibit that fails. Third, data provenance is a legal boundary: real regulatory reference material is dated and source-linked; every private party is synthetic and labelled. Illustrative data is never allowed to masquerade as evidence — the same discipline a court applies to exhibits.

04What it proves to a regulated employer

A sanctions or financial-crime function needs people who hold both halves: the typologies and the detection logic. Having built the screening, tracing and waterfall engines myself, I can interrogate a vendor's screening calibration rather than accept it, read an alert and know its legal consequence — escalation, SAR-grade narrative, freeze, or file — and translate between the MLRO and the engineers who tune the rules. For a forensic-analytics or investigations team, the same build demonstrates throughput: graph evidence, exact reconciliation and audit-ready working papers, produced by someone who understands what a regulator will ask of them.