import { FinCENRecord } from '../types/fincen';

/**
 * FinCEN Suspicious Activity Report (SAR) Regulatory Database
 * Form 111 / BSA E-Filing XML 2.0 Normalized Records for Regulatory Optimization
 * Exactly 8 curated records (strictly <= 10 records per specification).
 */
export const FINCEN_SAR_DATABASE: FinCENRecord[] = [
  {
    bsanId: 'BSAN-31000249871234',
    filingInstitution: 'Kraken Digital Asset Exchange (Payward Inc.)',
    institutionType: 'VASP',
    filingDate: '2026-08-31',
    reviewPeriod: '2026-08-01 to 2026-08-30',
    primaryCategory: 'TERRORIST_FINANCING_18USC2339B',
    secondaryCategories: ['MIXER_TUMBLER_OBFUSCATION', 'SANCTIONS_EVASION_OFAC', 'STRUCTURING_CTR_EVASION'],
    associatedCaseId: 'CASE-2026-CTF-8891',
    totalAmountUsd: 3450000,
    assetsInvolved: ['USDT (TRC20)', 'ETH', 'BTC', 'USD Wire'],
    regulatoryOptimizationScore: 98,
    optimizationTier: 'TIER_1_CRITICAL_ACTION',
    fincenStatus: 'OFAC_FREEZE_DISPATCHED',
    assignedTaskforce: 'FBI Joint Terrorism Task Force (JTTF) / HSI Illicit Finance',
    subjects: [
      {
        name: 'Tariq Al-Muhandis',
        alias: 'ShadowKey_99 / Hydra Operative',
        type: 'CELL_NETWORK',
        tinOrSsnMasked: 'XXX-XX-8891',
        country: 'United States / Germany / Iraq',
        walletAddresses: [
          'bc1qa9e8x77r9v34l2k0p8sdg7hydra99x10a2m3p',
          '0x71C882a9810aBc023199Fd12903Abcf81903412',
          '0x43A110b991209384110398109381029381029381'
        ],
        associatedIps: ['194.38.20.114', '185.220.101.42']
      }
    ],
    narrativeSummary:
      'Subject executed multi-stage on-chain layering routing $3,450,000 USD via Sinbad/Tornado mixers and Hawala corridors. Analysis revealed sub-$10,000 structuring smurfs across TRC-20 USDT deposit channels before consolidation into ETH mixer pools. Destination attributed to Specially Designated Global Terrorist (SDGT) procurement network.',
    actionableRecommendations: [
      'Issue immediate 314(a) emergency subject query to all registered MSBs and VASPs for wallet clusters.',
      'Transmit OFAC blocking notification under Executive Order 13224.',
      'Coordinate with EU FIU.net on correspondent bank Hawala wire settlements in Frankfurt and London.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000249871234</FC2:BSAID>
    <FC2:FilingType>INITIAL</FC2:FilingType>
    <FC2:SuspiciousActivityCode>TERRORIST_FINANCING</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>3450000</FC2:TotalAmountInvolvedUsd>
    <FC2:NarrativeText>Multi-hop crypto mixer de-anonymization with Anycast BGP origin triangulation linking Ashburn VA node to SDGT recipient.</FC2:NarrativeText>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000289110452',
    filingInstitution: 'Coinbase Compliance & FIU Operations',
    institutionType: 'VASP',
    filingDate: '2026-08-29',
    reviewPeriod: '2026-08-15 to 2026-08-28',
    primaryCategory: 'SYNTHETIC_IDENTITY_BUSTOUT',
    secondaryCategories: ['STRUCTURING_CTR_EVASION', 'UNLICENSED_MSB_HAWALA'],
    associatedCaseId: 'CASE-2026-FRD-9934',
    totalAmountUsd: 14200000,
    assetsInvolved: ['USDC (ERC20)', 'USD ACH', 'USDT (TRC20)'],
    regulatoryOptimizationScore: 94,
    optimizationTier: 'TIER_1_CRITICAL_ACTION',
    fincenStatus: 'TRANSMITTED_TO_LE',
    assignedTaskforce: 'IRS-CI Special Investigations / FinCEN High-Risk Fraud Cluster',
    subjects: [
      {
        name: 'Apex Zenith Logistics LLC (Ghost Shell)',
        alias: 'Titan_Apex_Fin Cluster',
        type: 'SHELL_CORP',
        tinOrSsnMasked: '83-XXXXX91',
        country: 'United States',
        walletAddresses: [
          '0x33F9b8210A88Bce0913Ac2890C3c33214aB07812',
          '0x8891cA1092837192830192830192830192830192'
        ],
        associatedIps: ['172.56.21.89', '198.51.100.88']
      }
    ],
    narrativeSummary:
      'Identified 42 coordinated corporate shell accounts executing programmatic micro-deposits calibrated between $9,750 and $9,920 to evade CTR filing requirements. Totaling $14.2M, fiat settlement funds were immediately converted to USDC and moved offshore to Dubai OTC desks.',
    actionableRecommendations: [
      'Trigger FinCEN Geographic Targeting Order (GTO) review for registered agents in DE and WY.',
      'Transmit automated Section 314(b) voluntary information sharing alert to partner crypto exchanges.',
      'Request asset restraint on 0x33F9...07812 unspent USDC reserves.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000289110452</FC2:BSAID>
    <FC2:SuspiciousActivityCode>STRUCTURING_BUSTOUT</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>14200000</FC2:TotalAmountInvolvedUsd>
    <FC2:NarrativeText>Automated headless botnet orchestrating 1,420 micro-settlements beneath BSA threshold with immediate offshore USDC conversion.</FC2:NarrativeText>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000301928471',
    filingInstitution: 'Circle Internet Financial LLC',
    institutionType: 'MSB',
    filingDate: '2026-08-25',
    reviewPeriod: '2026-08-10 to 2026-08-24',
    primaryCategory: 'MIXER_TUMBLER_OBFUSCATION',
    secondaryCategories: ['SANCTIONS_EVASION_OFAC'],
    associatedCaseId: 'CASE-2026-CTF-8891',
    totalAmountUsd: 2150000,
    assetsInvolved: ['USDC', 'ETH'],
    regulatoryOptimizationScore: 91,
    optimizationTier: 'TIER_1_CRITICAL_ACTION',
    fincenStatus: 'OFAC_FREEZE_DISPATCHED',
    assignedTaskforce: 'OFAC Sanctions Compliance & Enforcement Unit',
    subjects: [
      {
        name: 'DarkPool_Relay_Alpha',
        alias: 'Tornado Smart Contract Intermediary',
        type: 'AUTOMATED_BOTNET',
        country: 'Decentralized / Offshore',
        walletAddresses: [
          '0x12D699F109283719283019283019283019283019',
          '0x9928301928301928301928301928301928301928'
        ],
        associatedIps: ['194.38.20.114']
      }
    ],
    narrativeSummary:
      'Smart contract event analysis detected automated deposit and withdrawal cycle with near-zero time delta between blacklisted Tornado.Cash addresses and freshly spawned unhosted addresses. On-chain zero-knowledge circuit verification verified association with designated SDGT funding conduits.',
    actionableRecommendations: [
      'Execute blacklisting of recipient address on smart-contract contract level.',
      'File OFAC Report of Blocked Property pursuant to 31 C.F.R. § 501.603.',
      'Alert blockchain indexing providers of newly spawned relayer address clusters.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000301928471</FC2:BSAID>
    <FC2:SuspiciousActivityCode>SANCTIONS_MIXER</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>2150000</FC2:TotalAmountInvolvedUsd>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000318920194',
    filingInstitution: 'Western Union Financial Services BSA Unit',
    institutionType: 'MSB',
    filingDate: '2026-08-20',
    reviewPeriod: '2026-07-20 to 2026-08-18',
    primaryCategory: 'UNLICENSED_MSB_HAWALA',
    secondaryCategories: ['TERRORIST_FINANCING_18USC2339B', 'STRUCTURING_CTR_EVASION'],
    associatedCaseId: 'CASE-2026-CTF-8891',
    totalAmountUsd: 1850000,
    assetsInvolved: ['USD Cash', 'AED', 'PKR', 'USDT'],
    regulatoryOptimizationScore: 89,
    optimizationTier: 'TIER_2_HIGH_PRIORITY',
    fincenStatus: '314A_INFO_SHARING',
    assignedTaskforce: 'FinCEN Global Illicit Hawala Countermeasures Group',
    subjects: [
      {
        name: 'Kabul & Dubai Cash Clearing Hub',
        alias: 'Hawala_Kabul_CashNode_9',
        type: 'CELL_NETWORK',
        country: 'United Arab Emirates / Afghanistan',
        walletAddresses: [
          'TX99102830192830192830192830192830',
          'TY88102938102938102938102938102938'
        ],
        associatedIps: ['195.158.24.12']
      }
    ],
    narrativeSummary:
      'Informal Value Transfer System (IVTS/Hawala) network clearing cross-border book balances settled via stablecoin peer-to-peer vouchers. Counterparty matching tied cash drop locations in Dubai and Kabul to procurement of dual-use electronics.',
    actionableRecommendations: [
      'Issue FinCEN Advisory on unregistered crypto-fiat remittance corridors in GCC.',
      'Coordinate with UAE FIU for on-site inspection of OTC desk entities in Deira and Business Bay.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000318920194</FC2:BSAID>
    <FC2:SuspiciousActivityCode>HAWALA_REMITTANCE</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>1850000</FC2:TotalAmountInvolvedUsd>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000344591023',
    filingInstitution: 'Paxos Trust Company BSA Compliance',
    institutionType: 'TRUST_COMPANY',
    filingDate: '2026-08-18',
    reviewPeriod: '2026-08-01 to 2026-08-16',
    primaryCategory: 'RANSOMWARE_LAUNDERING',
    secondaryCategories: ['MIXER_TUMBLER_OBFUSCATION', 'SANCTIONS_EVASION_OFAC'],
    totalAmountUsd: 5800000,
    assetsInvolved: ['BTC', 'USDP', 'XMR'],
    regulatoryOptimizationScore: 92,
    optimizationTier: 'TIER_1_CRITICAL_ACTION',
    fincenStatus: 'TRANSMITTED_TO_LE',
    assignedTaskforce: 'FBI Cyber Division / National Cryptocurrency Enforcement Team (NCET)',
    subjects: [
      {
        name: 'BlackCat/ALPHV Ransomware Affiliate Wallet Cluster',
        alias: 'Crypt_Vault_Black',
        type: 'CELL_NETWORK',
        country: 'Russian Federation / Offshore',
        walletAddresses: [
          'bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh',
          'bc1q98239018230198230192830192830192830192'
        ],
        associatedIps: ['94.25.180.12']
      }
    ],
    narrativeSummary:
      'Extortion payment proceeds originating from healthcare sector ransomware incident were rapidly split across 250 peeling-chain UTXOs. Subsets of funds were converted via cross-chain bridges into Monero before OTC off-ramp attempts.',
    actionableRecommendations: [
      'Broadcast cluster hashes to NCET chain analysis portal for immediate seizure warrant drafting.',
      'Coordinate with CISA on infrastructure telemetry and decryptor key recovery.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000344591023</FC2:BSAID>
    <FC2:SuspiciousActivityCode>RANSOMWARE_EXTORTION</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>5800000</FC2:TotalAmountInvolvedUsd>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000367281900',
    filingInstitution: 'Binance.US Compliance & Surveillance',
    institutionType: 'VASP',
    filingDate: '2026-08-14',
    reviewPeriod: '2026-07-01 to 2026-08-12',
    primaryCategory: 'STRUCTURING_CTR_EVASION',
    secondaryCategories: ['UNLICENSED_MSB_HAWALA'],
    associatedCaseId: 'CASE-2026-FRD-9934',
    totalAmountUsd: 890000,
    assetsInvolved: ['USDT', 'USD', 'SOL'],
    regulatoryOptimizationScore: 86,
    optimizationTier: 'TIER_2_HIGH_PRIORITY',
    fincenStatus: 'E_FILED_ACCEPTED',
    assignedTaskforce: 'FinCEN BSA Electronic Surveillance Desk',
    subjects: [
      {
        name: 'Mule_Cluster_NorthWest',
        alias: 'FastTrack Liquidity Bot',
        type: 'AUTOMATED_BOTNET',
        country: 'United States',
        walletAddresses: [
          'Sol771892301928301928301928301928301928301',
          '0x5519283019283019283019283019283019283019'
        ],
        associatedIps: ['104.244.76.13']
      }
    ],
    narrativeSummary:
      'Account holder utilized multiple linked sub-accounts in name of disparate straw individuals to execute 91 rapid consecutive withdrawals of $9,800 USD within a 72-hour window. Temporal Benford analysis showed extreme divergence from natural randomness.',
    actionableRecommendations: [
      'Consolidate multi-account straw identity profile for FinCEN CTR evasion civil monetary penalty assessment.',
      'Flag automated API keys linked to proxy host AS7018.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000367281900</FC2:BSAID>
    <FC2:SuspiciousActivityCode>SMURFING_WITHDRAWAL</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>890000</FC2:TotalAmountInvolvedUsd>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000388102931',
    filingInstitution: 'Bitfinex Global Compliance FIU',
    institutionType: 'VASP',
    filingDate: '2026-08-08',
    reviewPeriod: '2026-07-15 to 2026-08-05',
    primaryCategory: 'SANCTIONS_EVASION_OFAC',
    secondaryCategories: ['TERRORIST_FINANCING_18USC2339B'],
    associatedCaseId: 'CASE-2026-CTF-8891',
    totalAmountUsd: 4900000,
    assetsInvolved: ['USDT (TRC20)', 'BTC'],
    regulatoryOptimizationScore: 96,
    optimizationTier: 'TIER_1_CRITICAL_ACTION',
    fincenStatus: 'OFAC_FREEZE_DISPATCHED',
    assignedTaskforce: 'OFAC Enforcement / UK Office of Financial Sanctions Implementation (OFSI)',
    subjects: [
      {
        name: 'Al-Quds Procurement Front Co.',
        alias: 'Shamal Trading & Logistics DMCC',
        type: 'SHELL_CORP',
        country: 'United Arab Emirates / Lebanon',
        walletAddresses: [
          'TL88192038102938102938102938102938',
          'bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4'
        ],
        associatedIps: ['185.220.101.42', '194.38.20.114']
      }
    ],
    narrativeSummary:
      'High-value Tether TRC20 transactions traced directly to sanctioned weapons component distributor. The beneficiary entity was confirmed matching OFAC SDN List ID 2024-8819 under counter-terrorism executive orders.',
    actionableRecommendations: [
      'Permanent asset freeze on remaining 1.8M USDT on-chain balance.',
      'Transmit joint intelligence briefing to HM Treasury OFSI and FinCEN Director.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000388102931</FC2:BSAID>
    <FC2:SuspiciousActivityCode>OFAC_SDN_MATCH</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>4900000</FC2:TotalAmountInvolvedUsd>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  },
  {
    bsanId: 'BSAN-31000410293847',
    filingInstitution: 'Silvergate Liquidating Trust AML Unit',
    institutionType: 'DEPOSITORY_INSTITUTION',
    filingDate: '2026-08-02',
    reviewPeriod: '2026-06-01 to 2026-07-30',
    primaryCategory: 'UNLICENSED_MSB_HAWALA',
    secondaryCategories: ['STRUCTURING_CTR_EVASION', 'SYNTHETIC_IDENTITY_BUSTOUT'],
    totalAmountUsd: 7300000,
    assetsInvolved: ['USD Wire', 'SEN Network Internal Transfers'],
    regulatoryOptimizationScore: 88,
    optimizationTier: 'TIER_2_HIGH_PRIORITY',
    fincenStatus: 'TRANSMITTED_TO_LE',
    assignedTaskforce: 'FDIC Special Investigations / FinCEN Enforcement Division',
    subjects: [
      {
        name: 'Vortex Capital Transit Ltd',
        alias: 'Offshore Arbitrage Rail',
        type: 'SHELL_CORP',
        tinOrSsnMasked: '98-XXXXX12',
        country: 'Cayman Islands / United States',
        walletAddresses: [
          '0x9923019283019283019283019283019283019283',
          '0x1102938102938102938102938102938102938102'
        ],
        associatedIps: ['198.51.100.88']
      }
    ],
    narrativeSummary:
      'Systematic nested banking structure utilizing correspondent account to clear third-party unlicensed virtual asset OTC transactions without required customer due diligence or state money transmitter licenses.',
    actionableRecommendations: [
      'Refer to FinCEN Enforcement Division for 18 U.S.C. § 1960 (Unlicensed Money Transmitting Business) indictment.',
      'Subpoena correspondent banking communication logs.'
    ],
    xmlPayloadExcerpt: `<?xml version="1.0" encoding="UTF-8"?>
<FC2:SuspiciousActivityReport xmlns:FC2="http://www.fincen.gov/bsa/xml/2.0">
  <FC2:ActivityDetail>
    <FC2:BSAID>31000410293847</FC2:BSAID>
    <FC2:SuspiciousActivityCode>UNLICENSED_MSB_1960</FC2:SuspiciousActivityCode>
    <FC2:TotalAmountInvolvedUsd>7300000</FC2:TotalAmountInvolvedUsd>
  </FC2:ActivityDetail>
</FC2:SuspiciousActivityReport>`
  }
];