VELLARIXX is the collection layer of financial intelligence. We detect capital extraction at the beneficial-ownership layer where it actually occurs — past the offshore reset, before disbursement, at evidentiary standard — using a signature library built from inside real operations, not from public record.
Every agency with capability lacks jurisdiction. Every agency with jurisdiction lacks capability. VELLARIXX was built to operate in the gap between them.
Every commercial financial intelligence platform operating today — including the leading enterprise analytical platforms — is structurally an analysis or dissemination product. They are sophisticated and valuable. Their value depends on data they did not collect: commercial transaction feeds, aggregated registry data, published sanctions designations, journalistic reporting. They make that data more powerful. They do not produce the signal at the layer where extraction occurs.
The capability gap is not an analytical gap. It is a collection gap. VELLARIXX occupies the layer that has historically been absent from the commercial intelligence architecture — the layer at which signal originates rather than the layers at which signal is processed. That position is held through access, presence, and time inside the environment that a chequebook does not compress.
The recurring product is a detection environment you run counterparties through. Behind it sits a bespoke investigations tier that keeps the environment calibrated — and doubles as the deepest engagement we offer.
The signature library, the eight-layer traversal, and the convergence rule, delivered as a screen: PASS · FLAG · BLOCK, with verdict basis, confidence, and reference. Recurring, scalable, integrated upstream of your existing AML stack. This is what institutions run at volume.
Named-analyst, evidentiary-standard packages that take a single high-stakes counterparty apart completely — full descent, network binding, protection mapping, submission-formatted. The same investigative work that derives new signatures and keeps the Gate live.
The software is reproducible; the asset is the signatures. Every bespoke investigation derives new signatures, which power the Gate, which screens at scale, which surfaces the next high-stakes target — which becomes the next investigation. The bespoke tier is simultaneously the engine of the product and the proof that its verdicts hold. A competitor can clone the platform. They cannot clone the investigations pipeline that keeps it calibrated.
The archetypes are jurisdiction-independent. Ukraine calibrated them under conditions no synthetic dataset could replicate — live operations, prosecution-confirmed outcomes, an environment engineered to defeat detection. That is why the proof is undeniable: eleven confirmed networks, $10B+ extracted, detection leads of eleven to fourteen months ahead of public enforcement, and zero detection by any other system in the same environment. The same capability is already operating across Eastern Europe — the documented networks do not respect the border, and neither does the collection that maps them. The Balkans, with confirmed structural homology to the Ukrainian architecture and the same Cyprus and BVI offshore reset, are the next structured deployment.
The same mechanisms operate wherever capital is extracted through hidden ownership. The SOE-barrier architecture behind the flagship Ukraine case recurs in Russian state energy, in certain Central Asian sovereign-wealth structures, and in Latin American extractive-sector procurement. Sanctioned-patron proxy acquisition runs through London and Vienna. The reconstruction pipeline — $800B, a post-conflict figure — is where extraction peaks, not where it ends. At the documented 10–31% extraction rate, that is $80–248B of scenario exposure entering disbursement channels you are expected to clear.
Not a compliance platform, not a screening tool, not a vendor with deeper database coverage — those analyse what already exists. VELLARIXX produces what does not. Each capability below is jurisdiction-independent; Ukraine supplies the proof case under each, but the class is the general statement.
The full detection mechanism runs as a guided sequence: the closed-loop that makes extraction invisible, the eight layers built to see through it, and the gate producing a live verdict — each with notes on what you are looking at.
Resolving beneficial ownership past the offshore reset to the natural-person apex, before capital commits. Validating guarantee instruments at sovereign-registry authority level. The recurring Gate function.
Proof · ~$77M in void guarantees caught pre-disbursement · 100% void rate
Reconstructing the full extraction network behind a counterparty — nominee cascades, cross-entity convergence, and the institutional protection that sustains it. Determining which channels are clean before a filing is made.
Proof · one facilitation node confirmed across all documented operations
Identifying extraction architectures and designation-bound actors before public enforcement acts, on a documented chronology. Signatures complete; enforcement follows months later.
Proof · 11–14 month lead ahead of public enforcement
The Gate is the recurring screen. The flagship is the finished intelligence assessment behind it — a single counterparty taken apart completely, delivered under NDA. Its spine is fixed across every engagement.
The gate output above is the recurring tier. Behind it sits the flagship: a finished intelligence assessment that takes a single counterparty apart completely — the product a client actually retains VELLARIXX for. Its spine is fixed across every engagement:
The last three items are the tell. A marketing document asserts conclusions; a finished intelligence product publishes its confidence, its gaps, and its alternatives. Full assessments run to dozens of pages per counterparty and are delivered under NDA — the structure above is what the trained reader should expect to receive.
The output is an input to your decision, not an action taken on your behalf. VELLARIXX produces intelligence at evidentiary standard — the standard regulatory and judicial submissions demand — so that whatever your own obligations require, the package is already equal to it. It does not prosecute, disrupt, or intervene, and nothing routes anywhere without your instruction. That boundary is deliberate: it keeps the capability an instrument of the buyer's judgment, and keeps the intelligence clean of the outcomes it informs.
Four steps, in order. First the architecture that makes capital extraction invisible. Then the eight-layer stack built to see through it. Then the gate producing a verdict on a live counterparty. Then the actionable intelligence it hands you. Each interactive runs in place — read the notes beside it for what you are looking at and why it matters.
Stolen capital does not vanish — it travels. Domestic budget is extracted, layered through offshore tiers until its origin is erased, then returns as apparent foreign investment to acquire the very infrastructure it was drawn from. The loop closes below the offshore-reset wall, invisible to any system that stops at Layer 3. This is the problem every layer that follows exists to solve.
Run the analysis and watch two traces climb at once: the outbound extraction chain (amber, left) and the inbound apparent-FDI chain (cyan, right), each running the full eight tiers past the Tier-3 offshore-reset wall. The test is whether both resolve to the same natural-person apex at the top.
If they converge on one person, the "foreign investor" is the party that extracted the funds — the loop is closed, and the gate returns BLOCK before disbursement. Run Scenario B to see the discrimination: economically linked, but the apexes do not match, so it holds at FLAG rather than BLOCK. This step proves the gate can detect the hidden structure; Step 3 proves it discriminates a real loop from a clean counterparty.
The stack runs from entity resolution at the surface to natural-person apex resolution eight layers down. Layers 1–3 are the commercial ceiling; Layer 3 is the wall. Layers 4–8 are categorically different operations — they need sovereign-registry access and in-jurisdiction presence a commercial vendor cannot reproduce. This is the answer to Step 1: the loop closes below the wall, so detection has to continue below the wall.
The wall sits between Layer 3 and Layer 4. Everything above it, standard KYC / EDD / commercial UBO products reach. Everything below it — nominee resolution, protection mapping, forward designation, sovereign apex — only VELLARIXX collects.
Eight layers is not a bigger number than five. The layers below the wall are different kinds of operation, not more of the same. That is the whole claim: adjudicated-evidence resolution, not aggregator resolution. And it is additive, not substitutive — your existing stack runs Layers 1–3; VELLARIXX adds the collection beyond the surface, formatted for direct integration into your SAR pipeline, on a pre-disbursement timeline.
The named counterparty, resolved across scripts and jurisdictions. Visible to standard KYC.
First-tier ownership, and guarantee validation at sovereign-registry authority level. Visible to enhanced due diligence.
Ownership through intermediate holdings, up to the offshore reset. The deepest commercial UBO products stop here.
Past the wall. Requires sovereign-registry access and structured offshore collection.
The natural persons functioning as nominees, resolved by registry cross-reference plus operational confirmation.
The institutional protection that lets a network persist through enforcement — and which referral channels remain clean.
Who will be designated before the list publishes. The predictive-validation surface.
Assembly across sovereign databases to resolve the apex no single registry holds. Terminates at the natural person, graded by confidence.
Step 1 showed the gate detecting hidden structure. This shows something a screening buyer cares about more: whether the gate discriminates. Two synthetic counterparties run the same eight layers at the same thresholds — one returns BLOCK, one returns PASS. The gate does not decide the verdict; the counterparty's architecture does. A gate that flagged both would be worthless. The proof of a real screen is not that it blocks the adverse entity — it is that the clean entity clears the identical scrutiny.
Run Scenario A and watch seven triggers fire across guarantee validity, nominee resolution, pattern convergence, on-chain de-mixing, protection capture, and forward designation — resolving to a named natural person at 96% confidence. Each trigger carries its signature ID.
Then run Scenario B. Same layers, same thresholds — every one clears. Watch Layer 3 continue past the standard termination and find no reset: transparent ownership, cleared for disbursement. That clearance, on identical scrutiny, is the calibration proof.
Read the layers again by what access each requires, not what it returns. Layers 1–3 are the commercial ceiling — entity resolution, guarantee checks, ownership to the offshore reset. Any capable vendor reaches them. Everything below Layer 3 requires access a commercial tool cannot hold.
The claim is narrow and it is the whole claim: this is collection capability of a kind previously held only at sovereign level — operated privately, at institutional speed and evidentiary standard.
A BLOCK is where the actionable intelligence begins, not where it ends. The gate produces an evidentiary-standard package a disbursement officer or financial-crime team can act on directly — formatted for the authorities that act, on a pre-disbursement timeline.
The boundary: VELLARIXX produces the intelligence; the decision — and any filing or referral — remains yours. The package is an input to that decision, produced before the wire clears — not an action taken on your behalf, and not a post-event alert filed after the recovery window has closed.
Behind the gate output sits the flagship — a finished intelligence assessment that takes a single counterparty apart completely. Its full anatomy — key judgments, entity registry, mechanism analysis, sourcing, stated gaps — is set out under
Ten confirmed extraction networks. One meta-protection layer that shields them. Three candidates under collection. Below, the same networks mapped against the five institutional domains they capture — and the single facilitation node confirmed across all of them. Read the notes for what convergence means and how it was established.
Each network is a coordinated group — officials, intermediaries, corporate vehicles — extracting state funds through a shared archetype. The five columns are the institutional domains any extraction must neutralise to operate: judiciary, prosecution, enforcement, security, investigation. A network survives by capturing the domains its mechanism is exposed to.
The convergence node is the finding that matters most on this site: a single facilitation node confirmed across all ten confirmed extraction networks simultaneously — shared nominees, overlapping appointment histories, coordinated registration timing, common layering chains. Select it to see how the connection was established. No single enforcement authority has assembled this, because it is only visible in the layer where all ten can be seen at once.
14 Networks in Registry · 15 Archetype Classes · 445+ Patterns · 5 Institutional Domains
Networks I–IX and XI extract funds. Each operates within one or two institutional domains, using specific fraud archetypes to divert capital from state coffers.
Network X extracts nothing. Instead, it provides the institutional protection that allows all ten extraction networks to operate without consequence.
The architecture is hierarchical. Remove any single extraction network and nine others continue. Remove Network X and the protection collapses.
Any one network, taken alone, looks like an isolated fraud a competent investigator might eventually reach. Convergence is the claim that they are not isolated — that a shared facilitation architecture connects them, and that the same node appears in all ten. That is a network-of-networks, and it is invisible to any view that examines one network at a time.
This is what the collection layer produces that no analysis layer can: the connective tissue between operations, assembled from shared nominees and coordinated timing across jurisdictions, before any single case has been made. The convergence node is the demonstration of the network-of-networks finding — not an assertion that they are connected, but the specific evidence class that establishes it.
The convergence map is the structure; this is the evidence beneath it. These are not projections or scenario assessments — the detection was derived from inside the operations, months before each became a matter of public record.
Every case here was invisible to the systems already screening for it — not missed, but structurally unreachable. This is the record of what the collection layer surfaced that nothing else could.
How it surfaced: traversal continued past the Layer 3 Cyprus reset where commercial UBO stops → nominee cascade unwound across BVI, CY, LU → apex resolved to a natural person at 96% confidence → the returning capital matched the origin it was drawn from. The loop closed on paper; the descent caught it.
How it was confirmed: an independent allied-government signal followed eleven months after detection — with the ownership map already assembled to Layer 8. The assets remain active; monitoring continues.
$2.4B+ active · 14 power grids · 96% UBO confidence
How it surfaced: the extraction mechanism resolved at the ownership layer → the five-domain protection map scored which institutional channels were captured → the two clean domains were identified → the referral was routed only through those. Clean-channel routing is why it reached court: eight indictments followed.
How it was confirmed: the routed referral produced enforcement action — $4M in cash seized, a three-year ledger recovered, eight indictments. The only referral in the corpus to reach court, because it was the only one routed clean.
$100M+ · $4M cash seized · 8 indictments
How it surfaced: each instrument was checked at sovereign-registry authority level → issuer held Class 16, the instrument required Class 13 → capital ratio and reinsurance class failed at origination → verdict: void before disbursement, not on default. Ten contracts, one signature (FG-003).
How it was confirmed: the authority-class determination voided all ten instruments before disbursement cleared — the loss never occurred. Proceedings against the issuing architecture are active.
~$77M void · 10 contracts · 100% void rate
A single facilitation node runs through every row of the ledger above. How the connection was established — and the network-of-networks it proves — is on the
A single apex node provided protection across five institutional domains simultaneously. The channels were not absent — they were structurally unavailable, captured at the point of referral before any outcome could be produced.
No referral routed through any of the five domains produced an outcome before VELLARIXX-derived intelligence was introduced. No detection by any system deployed in the same environment, across the documented corpus, is the same fact stated from a different angle. The protection architecture and the detection vacuum are one architecture viewed from inside it and from outside it.
Every adjudicated outcome in the ledger above passed through a channel the five-domain map scored clean first. The record exists because clean-channel routing does.
What is public here is the shape of the record — detection, interval, confirmed outcome, at registry granularity. The case files behind each row — dates, signatures, attribution to natural persons — are disclosed at named analyst briefing stage under NDA. The briefing begins with the condition precedent screen.
The screening products you already run are built on what has already surfaced — public filings, licensed feeds, prior enforcement. This is built from adjudicated prosecutions, structured as mechanism classes rather than entity lists, and pointed forward at the next pipeline. Three properties make it irreproducible: where the signatures came from, how they converge, and what they are positioned on next.
"100% adjudicated" is precise, and it is not a claim of predictive accuracy. It means zero speculative entries: every signature was derived from a court record, enforcement filing, or search-warrant evidence — not statistical inference over commercial data. Each carries nine fields; the last is the one no data broker can populate.
A vendor with OSINT access can approximate what coordinated bidding looks like; they cannot calibrate it against the confirmed actors named in adjudicated proceedings, because that requires prosecution access — which requires continuous in-country investigative presence — maintained since 2016, within a twenty-year operational record. The replication estimate is 24–36 months minimum with equivalent access, and equivalent access is the part that cannot be bought. The prefix on every signature ID encodes the source prosecution; the register that decodes them is disclosed at NDA tier. On the 56 of 445+ surfaced: what is gated is the signature content, not its existence — each of the 445+ is indexed to a named prosecution in the register, and the calibration method is identical across all of them. Seeing 56 in full is seeing the method; the remainder are the same instrument applied to cases still under NDA. The disclosure limit is contractual, not a coverage claim. The documented cases are the proof; the twenty years are the methodology.
Fifteen distinct mechanism classes: twelve confirmed against adjudicated outcomes, three candidate and pending collection. The count beside each is signatures surfaced at demonstration tier; the remainder of each class library is NDA-gated. Surfaced counts are disclosure, not adjudication — verdicts run on convergence, signatures firing together inside the 90-day window. Select a class to read its mechanism. The index is the catalogue; the map below shows how each class routes through the detection layers to the gate.
Two of the fifteen classes are demonstrated end-to-end on this site. The remainder are disclosed at NDA tier.
The closed-loop mechanism by which extracted state-sector capital is layered offshore and re-enters the procurement environment as foreign direct investment. Five operational windows, each with a distinct detection surface.
Counsel inside the system cannot audit the system that governs their own standing. Retained diligence answers to the architecture it should be exposing. Eight signatures, appointment-cycle and judicial-outcome derived.
The remaining thirteen classes, the full signature library, and case-provenance attribution are available at named analyst briefing stage under NDA. Three classes carry candidate designation — documented at evidentiary tier, requiring additional collection for elevation to confirmed status. The platform reasons under uncertainty rather than asserting flat conclusions.
No single signature is decisive. Gate adjudication operates on signature convergence: three or more within one archetype, in the same entity cluster, inside a 90-day rolling window. That gradation is what separates a SAR filed reactively, because one thing looked unusual, from an analytical product issued proactively, because the mechanism itself was observable. Select any class on the map and watch the count resolve to a verdict.
One class is the deliberate exception: ⑥ Institutional Capture scores the state, not the counterparty. At any signature density its gate output is channel-integrity routing — which referral pathways remain clean — rather than a disbursement verdict. The arithmetic still runs; what it adjudicates is the channel.
An entity-list tool — an SDN roll, a PEP database, a designated-parties feed — tells you who is named. A mechanism taxonomy tells you what they did, why it worked, and what else fits the same pattern. That is why the output is arithmetic: three signatures in one archetype, one cluster, 90 days → BLOCK. The ecosystem this ontology detected — the shared bridge nodes across the fourteen-network registry — is mapped on the
This is the property that makes the ontology intelligence rather than a record. The same contractors, the same guarantee market, the same municipal coordination network, and the same protection architecture that extracted from Ukrainian budget flows are positioned to capture reconstruction contracts. The library is not a memory — it is a map of an ecosystem about to operate again, on new money.
The $800B is the documented pipeline as estimated by IFIs, sovereign donors, and private-finance participants. The 10–31% is the empirically documented extraction rate across the confirmed corpus — and it sits inside the precedent range: SIGIR documented roughly 10–15% diversion on ~$60B in Iraq; SIGAR documented 15–30% on ~$145B in Afghanistan. The rate is not a projection; it is what reconstruction pipelines have historically lost, observed again. Multiplied, they give a scenario range — not a point estimate and not a forecast: the exposure if the same ecosystem operates on the new pipeline at the rates it operated on the last one. Candidate archetype ⑬ (Network XII) is already visible in its pre-extraction, asset-positioning phase — the configuration phase, caught before disbursement.
These are entry points, not a sequence — each drops you into the part of the mechanism that answers your question. Every one runs live inside How It Works and the Network map; this page is the index for readers who want to start from a specific doubt rather than the top.
You are about to wire $500M into a reconstruction energy project. You did the responsible thing and built a stack of safeguards. Turn over each of the five assurances you are relying on, and see what the documented record shows underneath it.
One instrument. One sovereign registry query at authority-class level. Class 13 required, Class 16 held — void from issuance, not on default. The fastest demonstration of what a pre-disbursement gate returns.
Same entity, same day, two records. What your existing enhanced due diligence returns, against what the eight-layer gate finds — and what would have been disbursed without it.
ARC-ME ⑦. Domestic budget extracted, layered through eight offshore tiers, re-emerging as apparent foreign investment to acquire the infrastructure those funds were drawn from. Compare standard compliance traversal against eight-tier intercept.
The same case on a time axis. Disbursement at month six. Public flag at month fourteen. The interval between them is the only window in which the control is architecturally distinguishable from the violation.
The operator surface — sixteen modules, the network registry, three full case files, the super-graph, degradation scenarios. Guided walkthrough calibrated to your institutional profile. Named request required.
Layer 3 is where conventional KYC, EDD and most sanctions-screening stacks terminate beneficial-ownership traversal. Offshore reset structures are engineered specifically to be terminal under those constraints. The claim is not that the gate sees more in the open — it is that traversal continues past the reset to natural-person attribution, at the only point in the sequence where the finding can still change the outcome.
Five assurances. Turn each one over. The demo runs in place below — nothing leaves this page.
The documented extraction rate across the corpus is 10–31%. At that rate the scenario exposure range is $80–248B — capital that enters your disbursement architecture as EPC contracts, sovereign guarantees or FDI vehicles, and exits as captured infrastructure assets. The only viable control point is pre-disbursement.
Direct sovereign registry query at Class 13/16 authority level. 24-hour turnaround. Validity determination, authority class, capitalisation ratio, reinsurance class status.
Layer 3–8 traversal of the FDI vehicle, EPC contractor or material supplier. 6th-degree depth, 47 jurisdictions, 96% UBO confidence. 24–72 hour turnaround.
Tier 1–4 supply-chain exposure mapped against documented active-capture mechanisms, for your specific portfolio and disbursement programme.
Layers 1–3 of the detection stack — the reach of your existing KYC/AML platforms — are systematically defeated by Layers 4–8 of the extraction architecture. The five-domain protection architecture is the mechanism by which these relationships persist without triggering existing transaction-monitoring rules.
Counterparty pattern-match against 445+ enforcement-confirmed signatures. Archetype association, confidence band, signature density, prosecution provenance. SAR-workflow formatted.
Five-domain protection mapping for the relevant institutional channel. Determines which referral pathways remain clean. Prevents referral into an adversarially-controlled channel.
Named analyst authorship, evidentiary-standard documentation, prosecution-grade sourcing. Eliminates the translation layer between intelligence product and regulatory intake — so a filing your obligations require is already at the standard the receiving authority expects.
A SAR filed to a captured channel is not a compliance success. It is a record — held by an authority that is a participant in the network — documenting that your institution identified the transaction and knew. In a captured jurisdiction that filing does not merely fail to produce an outcome; it is available to be weaponised against the institution that made it. The channel-integrity determination is the variable that decides whether your compliance process is protective or self-incriminating.
And when the examination comes, the question is not whether you ran a database query. It is whether your verification was adequate to the risk that actually existed. A completed check that stopped at Layer 3, in a transaction with documented exposure at Layer 8, is not an adequate record. It is a post-mortem.
The Intelligence Community has capability but lacks evidentiary standard. Law enforcement has jurisdiction but lacks the presence to detect at depth. Mutual legal assistance requests for beneficial ownership documentation in offshore jurisdictions run 18–36 months at standard cadence. The offshore layering cycle completes in 60–90 days. The evidentiary recovery window closes before the response arrives.
Layer 3–8 documentation produced from in-country sovereign database access — not MLAT-dependent. 18 database categories, 47 jurisdictions, simultaneous. 24–72 hours against an 18–36 month standard.
Counter-intelligence dimension assessment for documented networks with adversary exposure vectors. Super-cluster bridge node documentation, pipeline analysis, safe-haven convergence mapping.
Five forward enforcement scenarios modelled against the documented ecosystem. Each includes action set, post-action state, protection metric and clean-channel count.
Engagement runs both ways. VELLARIXX applies a condition-precedent screen to every institution it works with — the same verification standard applied to the counterparties you are asking it to screen. The briefing begins there.
Forensic intelligence operations background. Founded the firm. Authored the detection ontology.
Engineering and forensic-platform background. Architected the platform. Designed the graph-native pipelines and the predictive sanctions engine.
Background in financial intelligence and decision sciences. Operates across contested-information environments.
Legal background. Translates detection findings into statutory violations.
Intelligence background. Builds entity link graphs, maps network topology, reconstructs deleted source material.
Economics and cybersecurity background. Recovers digital trace material. Resolves pseudonymous subjects to natural-person identity.
VELLARIXX applies the same verification standard to the institutions it works with that it applies to the counterparties those institutions are screening. The screen runs in both directions, and it either clears or it does not.
If a VELLARIXX package, briefing document or capability assessment reached you directly, your response goes back through the same channel. No form required. The first conversation carries no commitment.
Forward the site or the demonstration materials to your compliance team, risk committee, or procurement-integrity group. The walkthrough is calibrated to be self-sufficient — a colleague receiving it cold can orient in about 25 minutes. No commitment, no timing constraint.
Your context briefing → the applicable archetypes and networks for your portfolio → scope, timeline, and structure of an engagement-tier deployment. Roughly a week to scope. No NDA required at this stage.
Direct entry to engagement-tier work — where existing counterparty exposure or a programmatic deadline makes scoping the slower sequence. Approximately two weeks to NDA-tier status. The condition precedent screen applies on every path.