FND004 · Network Intelligence

Network Risk Assessment

How risky is this entity network, and which part of it carries the risk?

The second clause is the product. A score without its components is a verdict without a reason, and this engine is built to return both.

FND004 Network Risk Assessment is the foundation capability that combines five weighted risk components into a single network risk score, a band, a set of named drivers, and a confidence figure derived from the evidence underneath.

FND001 says who the nodes are, FND002 what connects them, FND003 who stands above them. FND004 is the arithmetic that turns those three into a number an investigator can be asked to act on.

Risk indicators

Risk

Component reading exactly zero, which may mean unsupplied rather than absent
Sanctions exposure edge diluted by volume into the relationship mean
Ownership edge typed OWNS, PARTIAL_OWNER_OF, SHAREHOLDER_OF or ULTIMATE_OWNER_OF
Confidence reported as one over evidence that carried no confidence at all
High structural score on a large but otherwise ordinary network
Ownership depth at three or above, where the component is already capped
Score sitting just below a band boundary

Investigation actions

Read the risk components before the aggregate score
Treat a component reading exactly zero as unsupplied until confirmed absent
Act on a sanctions or control driver rather than on the score that diluted it
Check the confidence figure against whether the source edges carried scores
Check whether an unscored ownership type would move a score near a band boundary
State explicitly that the weights are uncalibrated defaults whenever they are argued over

Detection logic

Five components are combined by weight. The weights are defaults on the prioritisation weights object and are injectable at construction, so they are the governed starting point rather than a law of the model:

Entity risk 0.25, the mean risk score across entities

Relationship risk 0.20, the mean of type base score multiplied by edge confidence

Ownership risk 0.25, per path depth and stake multiplied by path confidence

Exposure risk 0.20, additive indicator scores plus connected high risk count

Structural risk 0.10, network size, edge count, ownership depth and density

The weights sum to 1.00 and the total is capped at 100.

Relationship risk assigns a base score by relationship type:

SANCTIONS_EXPOSURE 100

ULTIMATE_CONTROLLER_OF 90

CONTROLS 85

BENEFICIAL_OWNER_OF 80

TRADES_WITH and TRANSACTS_WITH 60

DIRECTOR_OF and SHARES_CONTACT_WITH 55

SHARES_ADDRESS_WITH 50

Any other type 40

Four of FND003's seven ownership types are missing from that list. OWNS, PARTIAL_OWNER_OF, SHAREHOLDER_OF and ULTIMATE_OWNER_OF all fall to the default of forty, which is below a shared address at fifty. An entity connected by a plain ownership edge therefore scores lower on relationship risk than one sharing a serviced office. Read the relationship component with the actual edge types in hand, because where they are these four the component understates.

Relationship risk is a mean, so volume dilutes severity. One sanctions exposure edge at a hundred among nineteen ordinary edges at forty yields a component of forty-three. The categorical finding survives in the drivers list and disappears from the number, which is why the drivers must be read alongside the score.

Ownership risk takes depth multiplied by twenty and capped at sixty, adds twenty-five where effective ownership reaches fifty percent or fifteen where it reaches twenty-five, multiplies the result by the path confidence and caps it at a hundred. Depth dominates: three hops already reaches the cap, so a deeper chain scores no higher than a three-deep one, and depth contributes more than a majority stake does.

Exposure risk is additive and capped at a hundred. A sanctions indicator adds forty, a PEP indicator twenty-five, adverse media twenty, a high risk indicator twenty, and anything else ten. Connected high risk entities add fifteen each up to a ceiling of forty-five.

Structural risk is pure shape: size times three capped at thirty, edges times one and a half capped at thirty, ownership depth times ten capped at twenty-five, and density times a hundred capped at fifteen. A large network scores high here regardless of conduct, which is why this component carries the smallest weight of the five.

An empty component scores zero and dilutes the total. A network with no ownership paths scores zero on a component weighted a quarter, which is indistinguishable from a network with fully evidenced benign ownership. Absence of data reads as absence of risk, and this is the most consequential property of the model.

Confidence is the mean of every relationship and ownership path confidence in the context. An absent confidence score defaults to one, so evidence that never stated its own confidence is counted as certain, and a context of wholly unscored edges reports the maximum confidence on the weakest possible footing.

Scores are banded as follows:

85 and above Critical

70 to 85 High

50 to 70 Medium

30 to 50 Low

Below 30 Very Low

Drivers are emitted sorted and deduplicated, and are the explainable half of the output. A driver states that a condition holds, not that it dominated the score: a control relationship driver fires on one such edge in a hundred.

Curated from fc-03-network-intelligence-library/intelligence-products/specific/FND004/README.md