Every failure in the case studies is a service run too late.
The engagements below are the recurring, forward-looking version of the evidence work courts and regulators eventually forced in each precedent case. Same tools, same documentation standard, same infrastructure — commissioned before anything is wrong, at a fraction of the after-the-fact price.
Five engagements, seeded from the twenty-case fraud register. Each carries its full case write-up below, with the precedent sourced from the primary record.
01 · Tech-assisted internal investigation, at resolution standard
On demand · surge capacity — General counsel · boards
The precedent — run too late. Airbus self-reported bribery via intermediaries, ran a tech-assisted review across more than 30 million documents, and earned a record €3.6bn coordinated DPA — the court record documented the machine-learning review that made it manageable. The finding-it-yourself discount is documented.
Source: SFO v Airbus SE — approved judgment (2020)
The engagement — run early.
- Scope with counsel under privilege; collect through the Intake with chain of custodyThe record of who held a piece of evidence and when — what makes an exhibit usable later. intact.
- AI-assisted review at disclosure scale, with the explainable, documented methodology courts and prosecutors have already accepted.
- Deliverables built for a self-report decision: findings report, exhibit bundle, and the methodology file that survives scrutiny.
What it changes. The economics of discovering your own problem: cooperation credit is priced on speed and completeness, and both are functions of review capability — proven at DPA standard, available before the dawn raid.
The case in full · self-report 2016 → DPA Jan 2020
Situation. By 2016, Airbus faced mounting evidence that aircraft sales across multiple markets had been won through third-party "business partners" paid success fees with no documented deliverables — surfacing as export-credit agencies began refusing applications over undisclosed intermediaries.
Task. Establish the full extent of the conduct — spanning more than 30 million documents, dozens of jurisdictions and a decade of sales — quickly and completely enough to self-report and earn cooperation credit rather than face prosecution on a regulator's timetable.
Action. Airbus self-reported, then ran a technology-assisted internal investigation at a scale no manual review could reach — the SFO's first exposure to AI-assisted review at that magnitude — handing prosecutors organised, source-traceable evidence rather than a data dump.
Result. January 2020: a coordinated deferred prosecution agreement with the SFO, France's PNF and the US DOJ totalling ~€3.6bn — then the largest global bribery resolution — with no corporate conviction. The court record documented the technology-assisted review; four years from self-report to resolution.
02 · Back-book rescreen
One-off or rolling programme — MLRO · group compliance
The precedent — run too late. After Danske broke, Swedbank told the market it had no comparable Baltic exposure — until journalists proved otherwise. The eventual response was a ~30-billion-transaction retrospective screen by external counsel and a SEK 4bn fine.
Source: Finansinspektionen — Swedbank fined SEK 4bn (2020)
The engagement — run early.
- Bulk retrospective screening of historic books against current typologies, sanctions exposure and current risk appetite.
- UBO re-resolution on legacy relationships — including UK LLP and nominee structures that passed onboarding years ago.
- A documented position for the board: what the book contains, what was exited, what was reported.
What it changes. The difference between announcing your own findings and having them announced for you. A rescreen commissioned quietly costs a fraction of one forced by a peer scandal — and produces a defensible public statement instead of a conviction for the wrong one.
The case in full · SVT exposure Feb 2019 → SEK 4bn fine Mar 2020
Situation. After Danske's €200bn Estonian scandal broke, Swedbank's leadership assured the market it had no comparable Baltic exposure. In February 2019, Swedish broadcaster SVT showed the same non-resident money had flowed through Swedbank's own Baltic branches for years.
Task. Establish — retrospectively, across more than a decade of activity — what the Baltic book actually contained, which flows should have been reported, and what the board knew when it denied exposure.
Action. External counsel rescreened roughly 30 billion transactions spanning 2007–2019, reconstructed the high-risk non-resident portfolio, and — unusually — the findings were published in full, separating the bank's remediation from its former management's statements.
Result. A SEK 4bn fine (March 2020), among Sweden's largest. The CEO, Birgitte Bonnesen, was prosecuted for misleading the market — convicted on appeal in 2024, then acquitted by the Swedish Supreme Court in April 2026 — but the enduring lesson is the published rescreen, now the reference methodology for back-book reviews.
03 · Proof-of-reserves and custody attestation
Recurring · quarterly or per event — Exchanges · custodians · their investors
The precedent — run too late. FTX lent customer crypto to its own trading arm with no records; the shortfall was US$8bn and estate professional fees alone passed $500m. On-chain evidence then carried the criminal case from charge to conviction in twelve months — the proof that reserves are verifiable when someone actually looks.
Source: US DOJ — Bankman-Fried sentenced to 25 years (2024)
The engagement — run early.
- Node-level verification of on-chain reserves against a reconciled liability set — not a screenshot, a method.
- Related-party flow tracingFollowing value through transfers, swaps and exchanges to show where it ended up. between the platform and any affiliated trading or lending entities.
- A recurring attestation artefact designed for counterparties, auditors and supervisors — MiCA- and FCA-regime-aware.
What it changes. Custody claims move from marketing copy to evidenced fact on a schedule. For the venue it is a sales asset; for its institutional clients it is the diligence file; for the supervisor it is the difference between assertion and record.
The case in full · collapse Nov 2022 → 25-year sentence Mar 2024
Situation. In November 2022 a leaked balance sheet revealed that FTX had lent billions of customer crypto to its own trading arm, Alameda. The exchange collapsed within ten days with an ~US$8bn customer shortfall — and no custody records worth the name. Its European arm, FTX Europe AG, sat in Pfäffikon, Switzerland.
Task. Reconstruct, largely on-chain, where customer assets had gone; prove the diversion to a criminal standard; and recover value for customers across dozens of insolvency estates.
Action. The estate and prosecutors rebuilt the books from the blockchain itself — wallet attributionA claim about who is behind an address. Never a ledger fact — always cite who made the claim and when., related-party flow tracingFollowing value through transfers, swaps and exchanges to show where it ended up. between exchange and trading arm, and reconciliation of on-chain reserves against customer liabilities.
Result. Indictment within a month of collapse; conviction in November 2023 — twelve months, charge to verdict, the speed benchmark for on-chain evidence; a 25-year sentence in March 2024. Estate professional fees passed US$500m: the price of reconstructing records that should have existed.
04 · Counterparty-concentration review
Periodic · per counterparty or portfolio — Prime brokers · credit committees
The precedent — run too late. Archegos ran the same concentrated bets through five prime brokers on swap; no lender aggregated the picture until it detonated for $10bn+, including $5.5bn at Credit Suisse. FINMA's report shows every signal sat in the bank's own data, unassembled.
Source: FINMA — concludes Archegos proceedings against Credit Suisse (2023)
The engagement — run early.
- Aggregate one client's true exposure across venues, entities and instruments — the question no single desk owns.
- Stress the margin model against the aggregated position, not the visible slice.
- A counterparty interrogation protocol: what to ask, what to verify, what to decline.
What it changes. The Archegos question — "what does this client look like from everywhere at once?" — becomes a standing control with a documented answer, instead of a post-mortem finding that every signal was in-house all along.
The case in full · collapse Mar 2021 → 18-year sentence Nov 2024
Situation. In March 2021, Archegos — a family office — held roughly US$36bn of concentrated equity exposure built through total-return swaps with at least five prime brokers, each seeing only its own slice. The unwind took days; banks lost over US$10bn, US$5.5bn of it at Credit Suisse.
Task. Establish how a single client concentrated that much leverage invisibly: what each margin desk saw, when, and why escalation failed — and for supervisors, whether the failure was information or organisation.
Action. CS's board-commissioned report, FINMA proceedings with an appointed investigating agent, PRA enforcement and the US prosecution together reconstructed the swap positions bank by bank — the cross-prime aggregation no one had run while it mattered.
Result. Hwang convicted July 2024, sentenced to 18 years that November; CSi fined £87m by the PRA; FINMA's 2023 report found every signal had been available inside the bank — the analysis was simply never assembled. The aggregation question is now a standing supervisory expectation.
05 · Monitoring stress-test — "would you catch it?"
Annual · or before a supervisor asks — MLRO · audit committee
The precedent — run too late. A gold dealer deposited £264m in cash with NatWest — bin bags, at branches — against a £15m projected turnover, and the systems let it run for years. The FCA's first criminal prosecution of a bank under the MLRs ended in a £264m fine. The failure was calibration, not technology.
Source: FCA — NatWest fined £264.8m (2021)
The engagement — run early.
- Replay documented typologies — Fowler Oldfield, Danske-pattern flows, current FATF cases — through your actual monitoring configuration.
- Measure what fires, what queues, and what dies in a workflow nobody reads.
- Deliver the calibration evidence supervisors now ask for: not "we have monitoring" but "here is proof of what it catches".
What it changes. Effectiveness testing stops being a regulatory aspiration and becomes an annual artefact — the exhibit that answers the supervisor's sharpest question before it is asked in an enforcement interview.
The case in full · deposits 2012–16 → £264m fine Dec 2021
Situation. Between 2012 and 2016, Fowler Oldfield — a Bradford gold dealer with projected annual turnover of £15m — deposited some £365m through NatWest branches, £264m of it in cash, at times in bin bags. Deposits outstripped the customer's stated business within months of onboarding.
Task. For the FCA: prove to the criminal standard — the first criminal prosecution of a UK bank under the Money Laundering Regulations — that the bank's monitoring and escalation failed against its own information.
Action. Branch records, CCTV, the monitoring system's actual calibration and the internal escalation trail were assembled into breaches of regs 8(1) and 8(3) MLR 2007; the separate criminal ring around Fowler Oldfield was prosecuted and jailed in parallel.
Result. December 2021: guilty plea and a £264m fine, sized to the deposits themselves. The case is now the standard typology for monitoring stress-tests — the calibration failure every bank can test itself against, before a prosecutor does.
Same rails
Risk work and opportunity work run on the same infrastructure.
Everything above uses the machinery already described elsewhere on this site: evidence lands through the Intake with chain of custodyThe record of who held a piece of evidence and when — what makes an exhibit usable later. intact, is worked in the Console, and ships with the documented, reproducible methodology that makes the output usable — to a court, a supervisor, or a counterparty.
When a matter is already live, the same team runs it as a Rapid Independent Review.
Case figures from public sources · verify before reliance.