One fraud payment freezes an honest account. The money mostly never comes back.
“Unwarranted orders for freezing accounts shall be discouraged, and accountability measures shall be established.”SOP Para 5(ix) · SOP-5-IX
A ₹1,200 grocery sale froze a ₹51,200 shop.
Toggle to Wapsi: the same trail, holding only the victim’s money in each account.
of what the freeze locks belongs to people who did nothing wrong: the landlord, the kirana shop and the payment-aggregator pool.
Who uses Wapsi
The bank’s cyber-fraud nodal officer, who traces split and layered money by hand, with an STR due within 7 working days.
Who it protects
The merchant who loses working capital and the customer who loses the account. The bank loses both, and answers the grievance.
Reinvent Commerce
Keep commerce running and keep the customer: hold the victim’s money, not the business.
Trace. Hold the amount. Verify. A human signs.
Trace the trail
Follow the complaint’s money through every layer of mule accounts, from NCRP / 1930 complaints, transactions and voice notes.
Tainted amount
Compute the victim money in each account, split per victim pro-rata. Separate mules from innocent holders and merchants.
Amount-specific hold
Hold min(victim money, balance) per account. Never a whole-account freeze unless an approved, recorded exception.
Verified drafts
STR, hold instructions, customer notice, restoration packet. Gemma 4 writes the words; the verifier recomputes every number and citation.
Maker-checker
A supervisor other than the analyst approves, bound to the draft’s SHA-256 fingerprint. Nothing moves without a human.
Audit chain
Every decision and every agent tool call goes into a hash-chained, append-only log per case. The tamper drill: 6/6 tampering attempts detected, 40-event chain.
From complaint to an approvable hold plan.
Four minutes, one honest shop, one trail.
Who uses it: seven people, one fair hold.
The nodal officer, the supervisor, call-centre staff, the police, the auditor, the shop and the agent: how each one uses Wapsi, in plain words.
One MI300X serves the whole copilot.
Measured 14 Oct 2026 on an AMD Instinct MI300X (AMD AI Notebook, ROCm 7.14, vLLM 0.23)
- Gemma 4 31B · BF16 · ≈62 GB weights
- KV cache + serving
- free: 94.7 GB of 191.7 GB
Device peak while serving: 97.0 GB of 191.7 GB. Whisper and the GNN were measured on the same GPU, each in turn.
Serving · AMD Instinct MI300X · 14 Oct 2026
| Concurrency | Output tok/s |
|---|---|
| 1 | 55 |
| 4 | 181 |
| 16 | 474 |
| 64 | 699 |
| 32 · real drafting prompts | 773 |
| Cases per hour (c = 16) | 1,590 |
| Drafts per GPU-hour | 12,274 |
| Cost per case at $1.99 / GPU-hour | $0.0013 |
Golden eval · 39 cases · a second MI300X (session 4) · 14 Oct 2026
| With Gemma 4 writing the prose | Result |
|---|---|
| Holds exact to the paisa | 1.0 |
| Drafts passing the verifier | 1.0 |
| Numeric accuracy | 1.0 |
| Citation validity | 1.0 |
| Injection leaks | 0 |
| Prose replaced by fixed text | 0.0332 (10 / 301) |
| p95 per case, to verified drafts | 11.1 s |
| Raw model, no slots: cases wrong | 0.4872 (19 / 39) |
per 1,000 cases. Gemma 4 on one MI300X at the $1.99 per GPU-hour list price, concurrency 16. Open weights on the bank’s own rack: the same code moves from AMD’s hosted API to one AMD GPU by changing three settings.
Same model. Only one gets the rupees right.
Gemma 4 writes. Google ADK runs the agent.
ModelGemma 4 31B
- Primary model for draft prose, complaint and voice-note fields
- Never types a number: placeholders only
- Every draft names the model that wrote it
AgentGoogle ADK
- 10 pipeline tools, native tool calls from Gemma 4
- JSON tool protocol as the safety net
- A reply with an amount no tool returned is replaced
EvidenceAgent trace
- Every tool call with guard and verifier verdicts
- Redacted and sealed into the case’s audit chain
- Replay is always labelled as a recording
Live run · AMD Token Factory (Gemma-4-31B-IT), 14 Oct 2026 · AMD-served, not an MI300X benchmark
Predictions · GNN trained on an AMD Instinct MI300X, 14 Oct 2026 · the role is predicted, never the money
| Hard world, 64 cases | Heuristic | GNN · MI300X |
|---|---|---|
| Mule ROC-AUC | 0.9411 | 0.9202 |
| Dispositions right | 0.9198 | 0.9198 |
| Innocent-holder recall | 0.6875 | 0.875 |
| Holds exact · over-hold | 1.0 · ₹0 | 1.0 · ₹0 |
What this is not, yet.
Limits we state
- All banking data is synthetic. No real customer, victim or bank data.
- CFCFRMS is a simulated interface; nothing is sent to the portal.
- The RBI money-mule SOP is a DRAFT (comments closed 2 Oct 2026), never treated as in force.
- GNN validation AUC 1.0 is on a saturated world; the heuristic stays the default.
- Our metric is money identified and held correctly, not money restored.
Next
- A pilot with one bank’s fraud desk on data it controls.
- Payment aggregators whose pool accounts get frozen.
- Voice intake with Whisper in the loop, measured end to end.
- A verifier-filtered LoRA of Gemma 4 on the MI300X.
- Price set after bank validation calls; 1,586 regulated entities are on CFCFRMS.