A mathematical map of where a company loses money and time: and where risks are hidden
KOKON connects to CRM, ERP, ticket trackers, BI and logs and builds a reproducible diagnostic: where money and time leak out, where risk is hidden, where structured schemes live in the data. Math computes the numbers, agents interpret, the Governor gates every action, the audit is sealed forever.
Three axes on one engine
One deterministic kernel covers three different questions. The cases below are grouped exactly along them.
Loss finding
Where money and time leak out: DSO and working capital, shadow IT, duplicate contracts, coordination gaps, process bottlenecks. Plus fabrication signals in journal entries.
Hidden risks
Distress and earnings manipulation (Altman / Piotroski / Beneish), counterparty concentration and contagion, model risk, insolvency cascades: what an ordinary report doesn’t show.
Financial crime
Structural laundering patterns in the connection graph: shells, nominees, sanctions nexus, crypto layers. A separate analytical contour: demonstrated on synthetic data.
From “Know Your Customer” to “Know Your Agent”
Banks already run live payments where an AI agent initiates and executes the transaction. Once an autonomous agent moves money, checking the human customer is not enough: you have to verify the agent’s own actions: deterministically and with an audit trail. The agentic cases below show exactly this: the engine holds fail closed under adversarial pressure.
Operations are already executed by agents
Mastercard ran the first live agentic payment (Hong Kong, March 2026, issuers HSBC and DBS); authenticated agentic transactions run across 9 APAC markets. McKinsey: up to $1 trillion in U.S. agentic transactions by 2030.
“Know Your Agent” is already a networks’ term
FIS, with Visa and Mastercard, is building agent authentication (Know Your Agent) to identify and authorize agent initiated transactions. Regulators require an explainable “reasoning chain” for every decision from such systems.
KOKON’s answer: proof, not narrative
Numbers are computed by a deterministic kernel, every step sealed into a receipt (PrevSHA to ChainSHA); where data is thin, the output is marked INDETERMINATE rather than invented. That is the auditable chain KYA demands.
Where a holding loses money and time
Cross entity diagnostics. Typed dollars: Recoverable / Exposure / Gap / Observation: are never summed: they answer different questions.
44 entities, 9 currencies to EUR consolidation
Loss map + fabrication signals in journal entries at group level. Every dollar denominated finding carries a ± band and a confidence tier (the lowest input wins).
DSO: trapped cash
E1: 48 days over terms: €422M one time release; E3: 58 days: €336M. Shadow IT and duplicate contracts add ~€8M/yr.
Fabrication signals in the GL
Round dollar entries €840M; to suspense accounts €535M; on non business days €418M; without a source document €255M.
ICFR: Material Weakness
Self approved entries €315M, combined “post+approve” €326M; ICFR aggregate €716M against PM €225M.
Cascade + tax
Eisenberg Noe cascade: E1 default: 4 covenant breaches, €1.78B shortfall. CbCR doesn’t reconcile with the books: €2.43B residual (BEPS 13).
Honestly: synthetic; when the Knowledge Brain is unavailable, confidence on enrichment dependent findings is downgraded (soft fail, flagged). Indicative analytics against the cited regime: not legal advice or a regulatory submission.
Adversarial fixture: 13 entities, 7 currencies
With planted traps (DSO “within norm” decoys, duplicated rows, matched book derivatives) so the engine doesn’t emit false certainty.
NRR erosion as an early signal
NRR slid 117.2% to 106.1% over 16 quarters; €77.7M forward risk. P&L looks fine today: the erosion is in the leading metric.
Distress before the trigger
E8 distress score 0.77 (leverage 7.2×, EBITDA down 46%); covenant breach net debt/EBITDA 7.2× vs 4.1×.
False positives refused
6 “elevated” DSOs within the regional norm are flagged as decoys: not as leakage. The engine doesn’t chase what isn’t there.
The cleaning trail is visible
Data quality surface (unresolved rows, duplicates, empty documentation): the “insufficient data + cleaning trail” framing; the engine claims no quiet success on dirty input.
Risk that isn’t in an ordinary report
Agentic cases under adversarial pressure. The metrics are honest: recall against planted ground truth, refusal of false positives (FP), holding INDETERMINATE when inputs are missing: that is the “Know Your Agent” guarantee.
TRINITY: triangulating distress and manipulation
Three battle tested composites intersect: Altman Z (bankruptcy), Piotroski F (fundamental strength), Beneish M (earnings manipulation). Forensic instinct: two of three flags = real distress; a conflict = an anomaly to investigate.
Two of three = real distress
ALL RED CO: Altman 1.50 + Piotroski 2 + Beneish negative 0.8: all three red, highest conviction. Composites triangulate; individual ratios don’t.
Strength that hides manipulation
CONFLICT CO: Altman 3.50 (safe) + Beneish negative 0.3 (manipulation): reported strength hides earnings management. A signal to dig into revenue quality.
No input: no number
A private firm with no market equity; explicit switch to the Z’ variant with disclosure, not a silent substitution; Piotroski without prior year and Beneish without SGAI; INDETERMINATE.
Leaves the healthy alone
HEALTHY / MODERATE / SAFE M: three healthy controls did not fire. Piotroski F=5 (moderate, not weak) and Beneish negative 2.5 (below threshold) correctly refused.
NEXUS FINANCIAL: contagion and the counterparty network
Diversification is a property of the graph, not the portfolio. Two exposures to different names through the same counterparty are one bet. Detectors walk the connection graph rather than computing yet another VaR.
A single point of failure
GAMMA BANK: 22% of the book (€600M); contagion path STRESSED ORIGIN / BETA DEALER / NEXUS in 2 hops (€300M).
A bottleneck and a chain reaction
CHIP SUPPLIER: 55% of critical inputs (€220M); Eisenberg Noe cascade on default ≥ 3 nodes (€4.24B); DebtRank NEXUS 0.42.
Your own trades move the market
NEXUS / HEDGE FUND A / NEXUS: a circular exposure of €160M, invisible to pairwise correlation. 43% of the book in one auto sector (€1.2B).
No node or amount: INDETERMINATE
A phantom node with no record, an unknown recovery on a bankrupt, undisclosed offshore edge amounts: concentration/cascade stay INDETERMINATE rather than assume 40%.
Honestly: both agentic cases are synthetic fixtures with a sealed answer key and sealed hash. Recall is measured against planted ground truth (planted GT); it is not a claim about detection rates on real data.
The AML contour: detecting structural schemes in the graph
External forensics: a connection graph across counterparties, transactions and ownership. A fully synthetic set with a known answer: a demonstration of the mechanism, not a finding about a real client.
Operation TIDEWAY: a 7 shell scheme in noise
A hard mode case built to break naive clustering and force recovery of the beneficial owner through a weak identifier graph.
BO via the weak ID graph
A cluster of 6 shells resolved by email/phone/nominee; beneficial owner Marcus Veil recovered without collapsing name collisions.
The shared agent didn’t fuse it with the legit
A generic registered agent shared by a shell and the legitimate Harborview family office. Naive clustering would have merged them: the kernel held.
Nexus to an SDN
Meridian Trade FZE is 60% owned by an SDN person; a bridge wire of $979,200 connects the cluster to the sanctioned side.
Mixer = an honest refusal
Path: shell / OTC / mixer / exchange ($1M). Verdict INDETERMINATE MIXER by construction: attribution is not invented.
Honestly: all entities are fictitious (synthetic fixture); live registries (GLEIF, OFAC, EDGAR) are disabled to rule out matches with real firms. Every finding is a LEAD (0 FILING), status HOLD FOR HUMAN REVIEW. Not a SAR, not a legal conclusion, not a registered AML/BSA service.
Boundaries of use
- ■All five cases are synthetic fixtures, self validated against a sealed answer key (sealed hash). Not an independent audit and not findings about real holdings or persons.
- ■The recall / FP / INDETERMINATE metrics are measured against planted ground truth: a characteristic of the mechanism, not a guarantee of results on your data.
- ■The financial crime contour: the output is a lead for a licensed specialist, not a SAR or a legal verdict. Live registries are disabled on synthetic data (defamation protection).
- ■Only capability classes are shown on synthetic data; internal thresholds, formulas and per seed metrics are provided on request.