OpenCheque FinCrime Network
Trace, contain and recover stolen funds across institutions.
FinCrime Network traces fraudulent funds as attributable value across participating financial institutions, and coordinates containment, return and escalation through the recovery mechanisms each institution already uses.
| Hop | Institution | Attributed | Available | State |
|---|---|---|---|---|
| 1 | Bank B | 100,000 | 15,000 | Contained |
| 2a | Bank C | 35,000 | 5,000 | Trace continues |
| 2b | Wallet D | 25,000 | – | External route |
| 2c | Bank E | 20,000 | 20,000 | Hold confirmed |
| 3a | Bank F | 30,000 | 28,000 | Return requested |
- Located
- USD 95,000
- Contained
- USD 40,000
- Still tracing
- USD 55,000
Illustrative case.
Sovereign data
Raw transaction data stays inside each institution. The authorized question moves to the data.
Recursive tracing
Value is followed hop by hop, through splits and merges, until it is recovered or the trail ends.
Policy-gated actions
Trace, hold and return are separate permissions. Each institution decides what may run automatically.
Built on existing rails
It coordinates the return and recall mechanisms banks already use. It is not a new payment rail.
Why it exists
Fraud moves across institutions at machine speed. Recovery should too.
Stolen money rarely stays where it lands. Within minutes it is split, moved through mule accounts at other institutions, and cashed out. Each bank can see only its own part of the chain, so recovery depends on emails, phone calls and portals while the funds keep moving.
FinCrime Network gives participating institutions one coordinated recovery process. An investigator sees a single recovery state for the whole claim, and does not have to work out which rail message to send, who controls the next hop, or which deadline has passed.
For an authorized fraud case, it answers and acts on
- Where did the funds arrive?
- What attributable value is still there?
- What moved onward, and which institution controls each next hop?
- What recovery action is available now?
- Can it run automatically under this bank’s policy? If not, what is the next best route?
- How much of the claim is located, contained, returned, unrecoverable or unresolved?
From reported fraud to recovered funds
How it works.
Open an authorized case
An investigator starts Trace and Recover from a confirmed or sufficiently authorized fraud case. The payment details come from the bank’s existing fraud or case system.
Trace, hop by hop
A Recovery Node inside each participating institution resolves the payment locally, attributes any onward movement, and child traces go out to the next institutions in parallel.
Contain what is recoverable
Where an institution’s policy allows, a hold is requested or placed on the attributable value that is still available.
Return, escalate, reconcile
The right return or recall mechanism is invoked for each hop. Missed deadlines escalate automatically, and every amount is reconciled against the original claim.
Attributable value
Honest about what can be traced.
Once money reaches an account and mixes with other funds, there are no identifiable “same dollars” to follow. FinCrime Network therefore traces attributable value, and states at every hop how the attribution was made and how far it can be relied on.
A recovery action is never presented as certain when it rests on a policy attribution.
Ways to participate
Join at the level that suits you.
Full Recovery Node
Automated local tracing, onward propagation, and policy-driven hold and return.
Trace Node
Automated tracing, with your own people approving every recovery action.
Connected workflow
No node to deploy. You are reached through a rail interface, a dispute platform or a secure operator workflow.
Outside the network
The trail does not stop at a non-participant. An evidence pack, an escalation and deadline tracking are created, and the boundary is recorded.
Safe by design
Agentic, within limits you set.
Software agents plan the work, call tools, retry, branch, wait and escalate without being prompted. They never invent a transaction, an amount or an authorization. Financial facts and money-moving actions come only from deterministic tools and policy engines.
- Each institution sets its own ceiling, from recommendations only up to automated containment and return.
- The Recovery Node runs beside the bank’s systems, not inside the core, and never writes directly to the core ledger.
- Nodes keep an outbound-only, mutually authenticated connection. No public inbound endpoint is needed.
- Messages carry institution identifiers, references, amounts and evidence digests, not customer identities.
- Every step on the timeline is backed by a signed machine event, ready for audit.
Scope
Built first for account-to-account payment fraud.
It complements what institutions already run. It is not a fraud detection platform, a central store of bank transactions, a new settlement rail, or a legal authority to seize funds.
What can be traced, held or returned in any case depends on the participating institutions, the rules of the payment rail and the applicable law.
- Authorized push payment and impersonation scams
- Account takeover transfers
- Business email compromise
- Unauthorized credit transfers
- Onward movement through mule accounts
FinCrime Network
Every institution that joins extends how far a trace can reach.
Tell us about the fraud losses you are trying to recover, and the rails and systems you work with. We will show you how a trace would run.
Talk to usTrust isn’t a feature.
OpenCheque
It’s infrastructure.