- Before
- Releases 20 to 40 wires a week and owns the 3:00 p.m. cut-off, trusting that someone compared each wire with the last one.
- Now
- “Show me the one payment I should not make, and why.” Opens the wire check with the call-back already done, and decides with a reason code.
Capital call processing for one notice: a lookalike email, stopped before it was paid
Quillfield Capital invests as a limited partner: 412 commitments to 168 GPs, held through 23 investing entities, about 3,100 notices a year. On Monday night an email arrives with “updated wire instructions” for Tollan Ridge Partners Fund VI, Capital Call 12 — $4,210,000. Here is what happens next, screen by screen, in the working solution.
- 01Tuesday, 9:40 a.m.
What needs him, and what the agents did overnight
Sam Patel · Treasury LeadSam's home shows four numbers: 38 open notices in 6 languages, $60.9M of calls due in the next 10 business days, 3 wire changes held and about $17.5M ready for treasury release. Under “Needs you” the first line is the Tollan Ridge wire change the GP says it never made. Beside it, the agents' night in plain words, each line cited.
“Blocked 2 emailed wire changes from a lookalike Tollan Ridge domain, $5,262,500.” — Fraud agent · Mon 9:17 p.m.
- 02The hour each notice lands
Every capital call and distribution notice read and recomputed
Reader and Recompute agentsThe notices list holds every capital call and distribution from portals, the mailbox and fund administrators, in due-date order. Each row says what the agents found in one line: a fee charged on commitments when the side letter says invested capital, a distribution not on the custodian statement, a faint scan whose due date the agents would not guess. Rows that pass every check wait for an analyst to book.
“Faint scan: the due date could not be read with confidence, so the agents did not guess.”
- 03Mon 9:17 p.m.
The wire against the fingerprint on file: payment blocked
Fraud agentThe amount is right — the Recompute agent rebuilds $4,210,000 from the $60,000,000 commitment and the 1.75% fee in LPA §8.1. The wire is not. Five of 8 payment details and 3 of 4 sender details differ from the fingerprint verified on Mar 3, 2025 and used for 11 payments: a new bank, Harborline National Bank in Wilmington, an account opened Sep 28, and an email instead of the GP portal. The Case agent finds the same email sent to the Wealth PE Access Fund for $1,052,500.
“Nothing is paid to these details until a call-back on the number on file confirms them and two people approve.”
- 04In the thread
He asks the agents, in plain words
Sam Patel · Treasury LeadOn the notice, the agents' conversation sits beside the evidence. Sam asks why the domain is suspicious. The Fraud agent answers with its source: the GP's real domain has been in use since 2009 and is signed; this one adds a hyphen, was registered Oct 10, 2026 through a privacy service and has no DMARC policy.
“Similarity 0.94; anything over 0.85 is held.” — Fraud agent
- 05Tue 8:12 a.m.
The GP's CFO, called on the number on file
Callback agentThe Callback agent calls Dana Whitcombe, CFO, on +1 (212) 555-0143 from Schedule B of the subscription agreement — never the +1 (302) 555-0186 printed in the email. It says the call is recorded and asks open questions without reading out the new details. The 2 min 41 s recording and its transcript sit on the call-back tab.
“No. We have not changed anything. We bank with First Meridian, account ending 8830.” — Dana Whitcombe, CFO
- 069:42 a.m.
He rejects both payments and opens the case, signed
Sam Patel · Treasury LeadSam rejects the $4,210,000 payment to Harborline •••• 4417 with reason code RJ-02, “Call-back says the notice is not genuine”. In the same step he rejects the second entity's notice, opens fraud case FC-2026-031 for the financial crime officer and puts the lookalike domain on the watch list. His name, role and the time are recorded on the audit trail.
“The genuine notice N-24791 stays booked and is paid to First Meridian •••• 8830 on Fri Oct 23.”
- 07Case opened
Every action drafted, every one his to approve
Marcus Oyelaran · Financial Crime OfficerThe Case agent built FC-2026-031: $5,262,500 attempted, $0 lost, how it was caught, the timeline and the evidence. It has drafted a letter to the GP, a request to block the domain at the mail gateway, a complaint to the FBI's IC3 and a notice to Harborline's fraud desk. Marcus opens each draft and approves it; the decision on regulatory reporting is his judgment.
The Case agent drafts only. Closing the case needs the financial crime officer and the operations manager to sign off.
- 08The genuine call
Booked by the maker, checked by someone else
Priya Raman and Elena MarshThe real Call 12, posted on the GP portal on Friday, passed every check. Priya Raman booked it on Oct 19 from the journal entries the Booking agent proposed: $3,900,000 investments, $262,500 management fees and $47,500 partnership expenses against capital calls payable. Contributions roll from $27,840,000 to $32,050,000 of the $60,000,000 commitment. Elena Marsh checks and posts it.
“A checker can never be the maker.”
- 09Before the cut-off
Only accounts that match a verified fingerprint can be paid
TreasuryPayments are grouped by release date against the 3:00 p.m. ET wire cut-off. Orrin Valley Energy Transition I, $2,150,000, must go today. Halvard Growth Equity V, $7,500,000, shows “1 of 2 approvals” because anything over $5M needs two people in treasury. The genuine Tollan Ridge call waits for its booking check, then pays on Fri Oct 23 — a day before the Saturday due date.
- 10On the record
Every read, call, decision and payment, chained
Ruth Calder · Internal AuditThe audit trail lists each step by person or agent, with the agent's version, the notice, the evidence, the reason code and a hash that chains it to the last. Sam's two rejections with RJ-02, the case opened and the domain put on the watch list are at the top. Internal audit exports an evidence pack for a case, an entity or a quarter.
“Chain intact.”