Twelve steps, six roles, one method.
This page covers the mechanics behind every case: the workflow, the organisation and roles, the architecture, how evidence is added and graded, the AI assistant and its guardrails, and how the final report is assembled. For the Operation Greece case itself, see that page.
Steps one to four set up the organisation once. From step five the investigation follows Keith Bulfin's workflow: the Lead Investigator opens the case, investigators add what they find, the system and the AI organise and question, and people decide.
The marker laps the ring on its own, step by step. A dashed step is the AI assistant: it suggests, it never decides. Navy steps are the two points the Lead Investigator owns.
The administrative layer. It gets the right people into the platform with the right role, kept apart from the investigation itself.
Work email, verified link, multi-factor authentication
Beta or Standard, assigned by GFIA
Enter its details; the owner becomes the first Case Administrator
Give each person a role from the method
The owner enters the details once. The platform creates an isolated space for the organisation and makes the owner its first Case Administrator.
The Case Administrator invites people by email and gives each one a role from the method. Each active member uses one seat.
| Member | Role | Status |
|---|---|---|
| A. Owner | Organisation owner, Case Administrator | Active |
| B. Lead | Lead Investigator | Active |
| C. Investigator | Authorised Investigator | Active |
| D. Analyst | Analyst | Invited |
| E. Security | Case Administrator | Active |
A multi-tenant, multi-organisation design. Services are shared; case data never is. One organisation runs the pilot; the architecture is designed so collaboration between organisations can be added later without a complete redevelopment.
A bank, regulator, FIU or agency is one tenant. A person can belong to several and switches between them.
Every record is tagged to its organisation, with row-level security, separate storage keys, search and AI indexes.
Organisation membership first, then case role. Without access to a case a person cannot see it exists.
No search, AI answer or recurrence check reaches another organisation's data. The same isolation is the foundation for multi-organisation collaboration later: each organisation keeps control over what it shares.
The case-opening record captures where the information came from, who and what is involved, the objectives, what is known, alleged or still open, and who may work on it. The system then creates the case reference, an initial chronology and a secure evidence register, and the Case Administrator grants access to the authorised people.
Completed by the Lead Investigator. Saving it creates the case reference, an initial chronology, a secure evidence register and a questions register.
Investigators and analysts record what they find as they find it. For the pilot, information comes from investigator entry and uploads only; approved external databases come later.
Document, interview, meeting, instruction, transaction, observation, recollection or note
Type it in by hand, or upload company records, trust deeds, bank records, correspondence, legal invoices, interview notes, instructions or statements
Source, date, author and reliability; the confidence level is set by the investigator
Contributions from other authorised investigators are reviewed before they enter the reconstruction
Placed on the chronology by when it happened, with possible relationships proposed and the audit history kept
Example data. Order from first-hand recollection; dates still to be established from documents.
Each pass round the loop either connects a piece with evidence or names what is still needed. Every item and link states how much is actually known. A case built on demonstration data additionally tags what is synthetic, separately from this confidence scale; see Operation Greece for that distinction.
At each significant stage, the system presents its findings, distinguishes established evidence from hypothesis, identifies missing information and suggests what to examine next. The investigator then accepts, rejects, modifies or defers the recommendation, and the system records that decision and the reasoning behind it.
The system never automatically promotes an investigative hypothesis to an established conclusion.
A hypothesis stays a hypothesis, however strongly the evidence points to it, until an investigator reviews the supporting evidence and the gaps, and makes that call themselves. The record keeps the hypothesis, the evidence considered, and who promoted it, separate and visible.
The assistant works only from the case material, cites its sources and says when the material is not enough. It operates inside the decision points above: it may suggest, it may flag, it never concludes.
The case records a registered shareholder: a retired schoolteacher resident in Switzerland R-005. The same recollection says he did not exercise control R-005. No document in the case shows who directed the company.
Evidence that would confirm or contradict: incorporation documents, the Lyon lawyer's correspondence and instructions, and payment records from the London account.
The investigation roles come from Keith Bulfin's division of responsibilities. The organisation owner's responsibilities stop at account administration. The investigator remains responsible for assessing evidence and making final decisions. The architecture is built to add further roles later, such as law enforcement supervisors, compliance officers, financial intelligence specialists and external reviewers, without changing how permissions work.
Opens the case, sets the objectives, reviews findings and approves conclusions. Signs off the report.
Collect information, upload documents, record interviews, examine transactions and add observations, subject to review.
Organises, extracts, suggests connections, finds contradictions and recommends questions. Every suggestion needs a person.
Manages access permissions, document integrity, audit records and security for the case.
| Action | Lead Investigator | Investigator or Analyst | Case Administrator | AI assistant | Owner (billing) |
|---|---|---|---|---|---|
| Open the case, set objectives | Yes | No | No | No | No |
| Invite members, assign roles, grant access | No | No | Yes | No | As Case Administrator |
| Enter information, upload documents, record interviews | Yes | Yes | No | No | No |
| Examine transactions, build the reconstruction | Yes | Yes | No | Suggest | No |
| Review contributions | Yes | No | No | No | No |
| Set confidence to verified or corroborated | Yes | Propose | No | No | No |
| Approve conclusions and the final report | Yes | No | No | No | No |
| Document integrity, audit records, security | View | Own items | Yes | No | No |
| Plan, seats and billing | No | No | No | No | Yes |
Access to sensitive evidence is controlled by role and by case: a person who is not authorised on a case cannot see that it exists, and every significant action any role takes is recorded in the audit log above.
Built up progressively as the case runs, and drawn together in the final report the Lead Investigator approves. The report identifies the evidence relied upon, the unresolved questions, and the decisions made during the investigation, together with the reasoning recorded at each decision point.
Every item with source, date, author, reliability and audit history
Events and decisions in the order they happened
Individuals, entities and relationships, each link with its evidence
Legal authority and effective control side by side
The movement of funds from origin to use
What is unresolved and what would resolve it
Every finding linked to its supporting material
Each principle comes from Keith Bulfin's methodology and applies everywhere: data, AI, screens and reports.
Unknown dates, names, amounts and legal forms stay unknown. No auto-fill and no AI gap-filling.
Legal authority and effective control are kept as separate kinds of link.
Source, date, author, reliability and confidence on every item, link and report line.
AI output stops at inference. Verified and corroborated need a person and evidence.
Searches, AI answers, recurrence checks and exports stay inside the organisation and the person's case access.
AI suggestions need acceptance. Conclusions need the Lead Investigator.
A permanent record of who changed what and when, including AI actions.
Demonstration records are labelled everywhere and never presented as historical evidence.
The system connects four investigative stages. They work together, not as independent reports: at the conclusion, the investigator has one coherent reconstruction of the financial operation, supported by an evidence trail and clear recommendations for further examination.
What happened, and in what order?
Where did the funds move, and through which institutions and entities?
Who owned, controlled, authorised or benefited from the arrangements?
What might the complete operation have involved, what evidence supports that assessment, and what remains unverified?
That coherence, evidence linked across all four stages rather than four separate outputs, is the central proposition of GFIA Investigation Lab.
Investigator entry and uploads first; approved external data sources later. Prediction comes last. Target launch December 2026, subject to technical readiness and a successful pilot evaluation.
For banks, regulators, financial intelligence units and law enforcement agencies.
See Operation Greece