Follow the money. Understand the people. Reconstruct the operation.
Operation Greece was an authorised undercover operation by Keith Bulfin, founder of GFIA, involving a reported US$9 million international financial arrangement. It is the first case used to demonstrate the GFIA Investigation Lab method: how an investigator starting from the outside can work from incomplete information towards a defensible, evidence-linked reconstruction.
Keith Bulfin knew the Operation Greece structures from the inside. An outside investigator does not. The platform is designed to help them find each piece, establish which pieces connect, and keep fact apart from recollection and inference.
A suspicious transaction, a company record, a bank account, an interview or intelligence from another agency.
Placed on the chronology, people and entities extracted, possible relationships proposed.
Investigative questions, inconsistencies and the evidence that is missing.
Only a person decides which connections are supported.
If a criminal organisation understands how existing detection systems operate, can our technology help an investigator reconstruct the underlying operation and identify what those systems may have missed?
Footprint tools gather data fast. The Investigation Lab interprets it. No digital link does not mean no financial link.
Knowing who the customer is does not explain the purpose of a complex transaction.
Known patterns miss new schemes. The method follows behaviour, decisions and paperwork.
Operation Greece is the demonstration of how the platform moves beyond detecting a suspicious transaction to reconstructing the financial operation, identifying the people involved, understanding the structures they used and recommending the next investigative steps. Transaction Flows, Ownership and Control, and Recurrence Analysis are not independent outputs: each one informs and corrects the other two as the reconstruction builds.
Where the money moved: the two trails through London, Luxembourg and into Mexico.
Who the registry names, and who actually directed the Guernsey and Gibraltar structures.
Whether the same entities, nominees and accounts appear again, beyond this one transaction.
For the mechanics behind each module, the twelve-step workflow and the role-based permissions that govern them, see How it works.
Operation Greece in the pilot's build order: France, Gibraltar and Guernsey first, then the London and Luxembourg accounts, then the movement of funds into Mexico. Fees paid from London link the structures on paper.
Historical recollections, not a verified transaction map. Do not infer that nominees had beneficial entitlement.
A registry can name a retired schoolteacher as the shareholder. It cannot say who directed the company. Switch views to see the difference.
What the paperwork says. Recorded exactly as found.
Registered shareholderDirectorNominee directorTrusteeSettlorBeneficiary as recordedAuthorised signatoryOwnsFormedWho actually made the decisions or benefited. Needs its own evidence.
DirectedInstructedActed on behalf ofBenefited fromExercised controlIntroducedPaid fees toThe system never turns a legal link into a control link. Not the database, not the AI, not the report.
Structures, nominees and accounts were not necessarily used once. Reconstructing only the US$9 million may miss the same pieces appearing elsewhere.
A company record or account
The same nominee, intermediary or account
What would confirm the link
Within the organisation, with permission
A person decides
Reported recurring corporate and banking links. Not a map of verified payment routes, and not part of the US$9 million transaction. Each needs its own investigation.
London, Milan, Geneva, Brussels, Amsterdam, Lisbon, Madrid, Frankfurt, Berlin
Brazil, Chile, Argentina, Mexico, United States
Morocco, South Africa
Dubai, Bahrain
The platform's purpose is not only to show what moved. It is to identify the questions an investigator should ask next, and guide them towards the evidence needed to answer each one.
Who controlled the two Guernsey companies?
What was the relationship between those companies and the Gibraltar holding trust?
Who authorised the transfers between London and Luxembourg?
What was the commercial justification for the loan to the Mexican company?
Who ultimately controlled the Mexican company and the restaurant investments?
What documentation would be required to verify the claimed source of funds?
Were there repeated relationships, transactions or intermediaries that would justify further examination?
This sits alongside, not instead of, the verified-to-uncertain confidence scale used throughout the platform: it marks where a statement about Operation Greece comes from, not how strongly it is held. Every synthetic record used to demonstrate the method is labelled as demonstration material and is never presented as an original historical record.
Established from records: company registries, bank statements, trust deeds and other primary documents.
What he observed or was told directly, undocumented until corroborated by a record.
Realistic mock bank statements, company records, trust documents, loan agreements and transaction records, built to show how the method works.
What the evidence suggests but does not yet establish; shown as a hypothesis until a person promotes it, with reasoning, to a conclusion.
Realistic mock records, built for this demonstration, are clearly identified internally as synthetic demonstration material, not original banking records from the historical operation. The objective is to demonstrate how the system reasons through an investigation, not to manufacture evidence.
Built up progressively as Transaction Flows, Ownership and Control, and Recurrence Analysis each add to the reconstruction, and drawn together in the final report the Lead Investigator approves. For how the report is assembled across every case, see How it works.
The corporate arrangements first
Establish the relationship with each structure
The loan, the retained amount and the restaurant interests
Between the paperwork, the people, the instructions and the transactions
Investigator entry and uploads first; approved external data sources later. Prediction comes last. Target launch December 2026, subject to technical readiness and a successful pilot evaluation.
How it works covers the twelve-step workflow, roles and the final report. Pricing covers Beta and Standard.
See how it worksSee pricing