US cybercrime losses reached $16.6 billion in 2024 — a 33% increase year-over-year and the highest annual figure since IC3's founding — with business email compromise alone accounting for $2.77 billion across 21,442 complaints.^{FBI IC3 Annual Report, 2024} The structural failure is architectural: ACH, Fedwire, and FedNow each operate under incompatible settlement timing, reversal rights, and fraud exposure profiles. Point solutions address one rail. Fraud actors exploit all three simultaneously, across the gaps between them.

Every fraud scenario is defined against a named primary source before a single model is trained. BEC wire diversion maps to FinCEN FIN-2019-A005. BSA structuring maps to 31 USC 5324. APP scams map to CFPB Circular 2022-04. The synthetic transaction generator is parameterized against the Federal Reserve Payments Study, NACHA ACH fraud reports, and FBI IC3 loss distributions — the same sources your BSA officer and audit committee already reference. No public dataset covers all three rails simultaneously at the granularity required for rail-calibrated detection. Building from regulatory statistics is not a compromise. It is domain discipline.

Eight fraud scenarios covering the complete material US payment fraud surface. XGBoost risk scoring with a 15-feature vector calibrated to US payment rail semantics. A three-agent LangGraph pipeline — Triage, Investigation, Escalation — with HITL interrupt on Critical-tier alerts and LangSmith observability on every agent call. Every alert delivers the full agent reasoning chain and a structured investigation memo. A risk score without a traceable rationale is not an actionable finding for a fraud operations team.

The PCAOB reported a 35% audit deficiency rate in 2023 — the highest in a decade — with internal control over financial reporting the leading deficiency category for the third consecutive year.^{PCAOB Annual Report, 2023} The ACFE estimates organizations lose 5% of annual revenue to occupational fraud, with financial statement fraud producing a median detection lag of 16 months — more than a full fiscal year after the control failure began.^{ACFE Report to the Nations, 2024} The detection gap is timing, not coverage. Most SOX 404 controls identify exceptions after the period closes — when remediation is reactive, restatement risk is already present, and the audit committee conversation is harder than it needed to be.

Every control scenario is grounded in a named COSO principle and regulatory citation before the ML layer is specified. Segregation of duties violations map to COSO Control Environment and PCAOB AS 2201 §28. Period-end manual journal entries map to SEC Staff Accounting Bulletin 99. System account postings map to PCAOB AS 2201 IT General Controls. This is a governance-aligned detection framework — not a threshold-violation exercise. Materiality is assessed per exception against configurable dollar thresholds that reflect your business reality, not a system default set at implementation and never revisited.

Seven control scenarios covering the complete SOX 404 exception surface. FLAML-selected ML classification with a three-agent LangGraph investigation pipeline — Classification, Materiality, Escalation — with HITL interrupt on Material-tier exceptions. Every exception produces a structured memo: materiality rating, COSO principle, regulatory citation, and recommended disposition. Every decision is logged to a full audit trail before the period closes — available for external auditor review and PCAOB inspection without additional documentation effort at period-end.