Nemesis Inside Correspondent Banking and Trade Finance: AML That Never Leaves the Bank

By Micky Irons, founder and CEO of Mickai

The barrier nobody priced in

Correspondent banking and trade finance are where dirty money hides best. Nested accounts, layered intermediaries, dual-use goods, over- and under-invoicing, vessels that go dark mid-voyage. The patterns are knowable, and modern machine learning is good at finding them. So why are so many banks still screening these flows with brittle rules written a decade ago?

Because the better tools live in someone else's cloud. For a large share of regulated firms, sending a SWIFT MT202COV or a letter-of-credit packet to a third party is not a procurement decision, it is a compliance breach waiting to happen. The data is special-category under UK GDPR. It sits inside PRA expectations on outsourcing and operational resilience under SS2/21. For institutions with US-touching infrastructure, the CLOUD Act turns a foreign government's subpoena into a back door. The cleaner the AML model, the more sensitive the data it has to ingest, and the harder it becomes to put that data anywhere you do not physically control.

That is the trap. Roughly 0.85 million UK businesses, around 15 percent, and roughly 5 million across the EU are effectively barred from public-cloud AI for exactly this class of workload. The market has answered with hosted AML platforms that ask the bank to relax its own posture. Nemesis answers the opposite way.

What Nemesis is, and where it runs

Nemesis is the fraud and AML Studio inside Mickai, the sovereign AI operating system. Mickai is AI that a regulated business owns and runs inside its own walls, on-prem or fully air-gapped. Nothing leaves the perimeter. The model, the inference, the case files and the analyst's notes all stay on hardware the bank controls.

For correspondent and trade-finance screening, that distinction is the whole game. Nemesis ingests the flows a financial-crime team already touches: payment messages, originator and beneficiary chains, the underlying trade documents behind a letter of credit, vessel and counterparty references. It scores them for the typologies that matter here: nested correspondent relationships, transit through high-risk corridors, goods-price anomalies that signal trade-based money laundering, and the structuring patterns that try to stay under reporting thresholds. The screening happens beside the data, not in a far-off region. No egress, no third-party processor, no transfer-impact assessment that has to explain why customer data crossed a border.

This is the point worth being plain about. Mickai is built and live. Nemesis is not a roadmap promise, it is a Studio that runs today on infrastructure a bank already trusts.

Every alert, written to a record that cannot be quietly changed

An AML programme is only as defensible as its evidence trail. When a regulator or a court asks why an alert fired, was escalated, or was closed, the answer has to be complete and it has to be tamper-evident.

Nemesis writes every alert, every model decision, and every analyst action to the Mickai audit record, the OAR. The OAR is post-quantum-signed, so the integrity of that trail holds up not just against today's adversaries but against the harvest-now-decrypt-later threat that already shapes how serious institutions think about long-lived records. Each entry is cryptographically chained, which means a change to one record breaks the signature on the rest. You cannot edit history without it being obvious.

For a financial-crime function, that turns the audit trail from a liability into an asset. The model can be explained, the decision can be reconstructed, and the integrity of the whole chain can be proven mathematically rather than asserted. That is the kind of evidence a supervisor wants to see, and it is generated automatically, on-prem, as a property of the system rather than a bolt-on after the fact.

Why this is a moat, not just a feature

Anyone can claim on-prem AML. Doing it as a sovereign operating system, with a signed audit substrate underneath every Studio, is a different order of engineering, and it is protected. Mickai LTD holds 104 filed UK patent applications, around 2,340 claims, with Micky Irons named as inventor. Filed, not granted, which gives priority dates and a prior-art moat rather than a promise.

That estate is broad enough that 196 companies map to 311 patent-company pairs as potential licensees, including names like Microsoft, AWS, NVIDIA, Google, Adobe and IBM. That is potential-licensee sizing, not signed revenue, but it tells you where the architecture sits relative to the industry. Mickai is not trying to be an OpenAI killer. We are an ally to the regulated economy and, increasingly, to the hyperscalers who cannot serve the sovereignty-bound segment with their current model. The dual-buyer thesis is exactly that: sell sovereignty to the firms that need it, and hold IP a cloud giant would rather own than route around.

As a third-party momentum signal, in June 2026 Micky Irons was ranked number four on Crunchbase, with the Mickai company in the top one to two percent globally. That is a marker on the way up, not the destination.

Nemesis is one Studio of many

Financial crime is the entry point, but the operating system is the prize. Nemesis sits alongside Plutus for finance, Tyche for underwriting, Prometheus for forecasting, Nomos for compliance, Astraea for legal, Aletheia for audit and others, every one of them running on the same sovereign substrate and writing to the same signed record. A bank that adopts Nemesis for correspondent screening has already deployed the foundation for the rest. The marginal cost of the next Studio is small, the switching cost away from the platform is large, and the compliance posture is consistent across all of it.

That is what makes this a category rather than a product. The sovereign AI market is on a path from around USD 40 billion in 2025 to roughly USD 148 billion by 2032, and the part of it that is structurally barred from the cloud has had no real answer until now. Mickai is a UK company, with Birmingham manufacturing secured, building to scale and heading for the top.

The window

We are opening this to a small set of selected banking and trade-finance partners. The aim is not volume. It is the right institutions, the ones whose correspondent and trade flows are exactly the workload Nemesis was built for, deploying it where the data already lives and proving the audit trail under real supervisory scrutiny.

If that is your institution, the conversation starts at micky@mickai.co.uk.

FAQ

Does any transaction data leave the bank when Nemesis screens it? No. Nemesis runs on-prem or air-gapped inside the bank's own perimeter. Payment messages, trade documents and case files are scored beside the data. There is no cloud egress and no third-party processor.

How does Nemesis make AML alerts defensible to a regulator? Every alert, model decision and analyst action is written to the Mickai audit record, the OAR. It is post-quantum-signed and cryptographically chained, so the trail is tamper-evident and any change breaks the signature. Decisions can be reconstructed and proven, not just asserted.

Why can't these firms just use a hosted AML platform? Roughly 0.85 million UK businesses and around 5 million across the EU are barred from public-cloud AI for special-category workloads by rules including UK GDPR, PRA SS2/21 and the CLOUD Act. Hosted platforms ask the firm to weaken its posture. Nemesis keeps the workload sovereign instead.

Is Nemesis available now? Yes. Mickai is built and live, and Nemesis is a running Studio, not a roadmap item. It is being opened to a selected set of partners.

Frequently asked questions

Does any transaction data leave the bank when Nemesis screens it?

No. Nemesis runs on-prem or air-gapped inside the bank's own perimeter. Payment messages, trade documents and case files are scored beside the data. There is no cloud egress and no third-party processor.

How does Nemesis make AML alerts defensible to a regulator?

Every alert, model decision and analyst action is written to the Mickai audit record, the OAR. It is post-quantum-signed and cryptographically chained, so the trail is tamper-evident and any change breaks the signature. Decisions can be reconstructed and proven, not just asserted.

Why can't these firms just use a hosted AML platform?

Roughly 0.85 million UK businesses and around 5 million across the EU are barred from public-cloud AI for special-category workloads by rules including UK GDPR, PRA SS2/21 and the CLOUD Act. Hosted platforms ask the firm to weaken its posture. Nemesis keeps the workload sovereign instead.

Is Nemesis available now?

Yes. Mickai is built and live, and Nemesis is a running Studio, not a roadmap item. It is being opened to a selected set of partners.