On-premise fraud detection, in motion: watch Nemesis catch a laundering ring before the money moves

Fraud moves at the speed of a payment, so a fraud engine has to decide inside the authorisation window, on hardware you own, and afterwards prove exactly what it knew and when. We built Nemesis, the fraud and crime detection studio inside SIOS, to do precisely that, and we filmed it. Here is the demo, and what it shows a payment company that a slide never can.

The catch, before the money moves

The film opens where the work happens: a flood of honest payments a second, with theft hidden inside moving just as fast. Nemesis scores every transaction as it happens, on your own hardware, in milliseconds, and returns one of three answers your switch can act on: allow, step up, or decline. Every line carries the decision, the top reason, and the milliseconds it took.

The climax is speed. A wallet is drained minutes after a SIM swap. Nemesis catches it and holds it in a few milliseconds, before a single unit moves, and records the decision the instant it is made, not after the fact. Then it tells you why in plain language, never a bare score: the balance drained in minutes, a brand new beneficiary, a SIM changed overnight. A decision an examiner can read is a decision you can defend.

Six transfers, or one laundering ring

A single transaction view sees six ordinary transfers. The graph sees one laundering ring. In the demo, six innocuous receipts resolve into a shape: a mule funnel fanning out from a drained victim on one side, a colluding agent and its ring of accounts on the other, joined by a single bridge. A clean account sitting in the same data stays green and outside the net, because the point is to discriminate, not to paint everything red.

Structure is the signal that transaction level scoring never sees. It is also where mobile money crime actually lives: SIM swap takeovers, agent cash out collusion, and structuring where every individual transfer sits just under the reporting line until you add them up within the hour. Nemesis fires one aggregate alert where no single payment ever would, with the arithmetic and the contributing transactions attached.

A record you can verify yourself, offline

Every consequential action is sealed to the Open Audit Record: an append only, hash chained, signed trail that you can verify yourself, offline, under your own key. In the film we alter one entry on purpose, and the chain goes red and names the break. It is a hash chain, not a blockchain: no consensus, no mining, no network. The timestamp is your operator clock and the signature is your key, which is why we hold neither your data nor your ability to re-sign your records. A regulator can be handed a scoped bundle and a standalone verifier and confirm the whole trail on an air-gapped machine.

It lands as a layer, not a replacement

The part a CTO wants to see is how it installs. Nemesis does not replace your switch. It docks beside it as one decision and audit layer: your rails, your name, your control, with one new opinion on every transaction. It never holds funds, never posts to your ledger, and never talks to the card networks. There are three ways in, and most sites run all three at once: a live decision inside the authorisation window over ISO 8583 or ISO 20022, a near real time stream for the patterns that take longer to show, and batch for history.

Nemesis advises and your switch enforces, so a problem in the fraud engine can never become a problem on your rails. It runs on ordinary processors by default, with a GPU optional and never required. And nothing goes live on a hope: it scores your real traffic silently first, you compare it against your current outcomes, and only then do you switch on enforcement one channel at a time, with a way back at every step.

Run it, carry it under your brand, or license it onward

Because it runs entirely on your own infrastructure, you choose the posture: on your own metal, in your private cloud in country, or in a sealed air gap enclave. The software is the same in all three, and the only thing that ever moves is a signed update coming in. Data never goes out.

That opens more than a defence. Run it, and you can also carry it under your own brand, offering fraud and crime detection to every customer on your rails, with their data still never reaching us. Or extend it across your network to other payment companies, licensed by patent family. You can walk in to buy a protection and walk out with a product to offer.

What we do not claim

We are precise about the edges, because a technical buyer forgives a young platform for lacking a twentieth enterprise report and never forgives a claim that does not survive scrutiny. Our patents are filed, not granted. We hold no security certification and do not pretend to; we lean on the architecture and welcome the review. A screening no-match is never a clearance: it reads as no match against these lists, at these versions, at this time. The detection brain is named by a sovereign alias, runs on your device, and never calls out. And throughput is sized on your hardware and proven in shadow, not quoted from someone else's box.

One studio holds all of it: monitoring, investigation, compliance, payments operations, detection and governance, thirty working surfaces on one system, in your building, in your country. Watch the demo, then pull the cable, and it keeps scoring, screening and verifying, because there was never anything to phone home to.

Frequently asked questions

Does any transaction or customer data leave our environment?

No. Nemesis runs entirely on your own hardware, offline. Scoring, screening, models, lists and the audit ledger are all local, and you can prove it with the network physically disconnected.

Is it real-time, or overnight batch dressed up?

It is inline, in-flight scoring on the authorisation path, returning a verdict inside the payment window, with the batch and investigative work sitting alongside it, not in place of it.

How does it integrate with our switch?

As a decision layer beside the switch: you send the event, it returns allow, step up or decline plus reason codes and an audit seal reference, and your gateway enforces. Nemesis never touches funds, the ledger, or the card networks.

Can a regulator verify the audit trail without us?

Yes. Verification needs only the ledger and your public key, no vendor and no network, so a scoped bundle can be checked offline on an air-gapped machine.

Can we offer it to our own customers?

Yes. It can be embedded under your own brand for the customers on your rails, or licensed across your network to other payment companies, each running on their own hardware, offline.

Nemesis is the fraud and crime detection studio inside SIOS, the Sovereign Intelligence Operating System by Mickai. It is jurisdiction configurable, from UK and US to EU and goAML regimes, through swappable regulatory packs. Watch the full demo above.