Mission Status

Where NEXUS stands today.

A living snapshot of the platform — what's built, what's in flight, and what's next. For the destination and the phase arc, see the roadmap.

Updated 12 October 2026 · Beta v2.1

Current position

NEXUS now runs as one governed, deterministic batch.

The substrate, detection and scoring across every crime family, and the fused investigator console are built and merged — governed, deterministic, and tested end to end. Since Beta v2.0 the copilot has grown to three live slices (SAR draft, EDD memo, disposition support), five fused investigation cases are public, doctrine is authored for all 57 typologies, capital markets manufactures its first product, and every published run can be rebuilt from a clean clone — see the v2.1 release notes. Since v2.1 the operations layer is complete: a tamper-evident case event log as the system of record, the SAR lifecycle, SLA orchestration and QA oversight, all driving the live ops dashboard — see what changed since v2.1. Now the pieces run together: one governed batch over a bank-scale synthetic estate of 9,889 entities, from daily feeds through ingestion, detection, manufacture and fusion to operations decisions — 7 of 7 phases, and a replay reproduces the run's fingerprints exactly. Simulated analysts, an officer and a reviewer exercise the SAR lifecycle and QA oversight at volume, and a sanctions lane sets designated hits aside — visible, not worked — so analysts reach the analytics-flagged work; the live console shows the lane. See the batch, 30 September to 12 October. Still synthetic data throughout.

Console · Beta v2.1 Copilot · 3 slices live 5 investigations public Operations layer · 4 of 4 built Governed batch · 7 of 7 phases 5,554 tests · 0 failed · CI-gated

Coverage by crime family

The detection families running on the shared resolved-entity substrate.

Built

Network intelligence

Entity resolution and the resolved graph — the substrate under every typology — with five foundation products (FND001–FND005) and ten network typologies (PAT001–PAT010).

Built

Trade-based ML

Trade-based money-laundering typologies, incl. circular funds flow and settlement mismatch.

Built

Sanctions

Screening and exposure analytics; sanctions matches escalate the alert band.

Built

Correspondent banking

Nested-relationship and pass-through typologies across the banking family.

Built

Capital markets

CM003 spoofing / layering now manufactures as a governed product — the first capital-markets product — alongside its live console detector.

The chain — layer by layer

The operating model, base to top. Layers built and merged; deferred pieces noted honestly.

Data & typology foundationCanonical pillar model + daily-delta runtime + typology library · a daily feed simulator and an ingestion engine · doctrine authored for all 57 typologies

Built

Entity resolutionOne shared entity key + the resolved global graph + Neo4j store

Built

Analytics & detectionNetwork · TBML · sanctions · correspondent banking · capital markets

Built

Risk scoringPer-typology weighted components + KYC deviation → ranked alert table · behavioural/temporal deferred

Built

Investigation & operationsCase-lifecycle state machine + task queue + audit · each task linked to its case files

Built

Operations managementSupervisor MI & KPIs over a tamper-evident case event log · SAR lifecycle with deadlines · SLA breaches routed to the supervisor and work allocated by priority and capacity · QA oversight of decisions after they are made · a sanctions lane, visible but not worked

Built

AI copilotThree live slices on grounded context: SAR draft, EDD memo and disposition support, each provenance-linked

Built

Fused investigator consoleInvestigate + manage on one screen, over the whole substrate

Built

Published investigationsFive fused cases public and linked to one another; every published run reproducible from a clean clone

Built

Governed batch at bank scale9,889 synthetic entities · feeds → ingestion → detection → manufacture → fusion → simulated decisions · 1,500 products and 150 master cases · 7 of 7 phases, replay fingerprints equal

Built

In flight & next

Operational surface — Investigator WorkspaceOne alert = one three-panel object (pattern · tunable score · governed decision), replicable per typology

Weekly drift checkA weekly re-run of the batch, compared with the last good run, with any change attributed to the inputs that moved — specified; nothing scheduled yet

TM Tuning StudioStress-testing the monitoring rules against planted truth — all ten weeks built, eight decisions logged; see Update Pack 05

Built

Threat intelligenceSlice 1 built and published — agentic advisory extraction grounded on the Knowledge Centre, scored against a 20-advisory labelled set. Slice 2 complete: a weekly scheduled run reads OFSI, FinCEN and OFAC, triages what is new and extracts the relevant advisories; nothing enters the record until a person accepts it, and the first live advisory has now been accepted that way

Live

Engineering posture

GovernedEvery build versioned, validated, reviewed and merged behind a CI gate on a protected main.

DeterministicOutputs are byte-identical to rebuild, and a whole batch replays to the same fingerprints — no hidden randomness.

TestedFive-layer functional matrix per typology, and guards proved to fail when what they guard breaks.

Evidence-ledEvery alert traces to the data, the score components and the action to take.

NEXUS · Mission Status · living snapshot · updated 2026-10-12 — see the roadmap →