Statement Integrity API
The forged statement already cleared review.
Your loan officer had ninety seconds and no reference for what a real statement from that bank looks like. Vepiom recomputes the ledger, checks the file against its issuer's actual template, and shows your team the exact row where the numbers stop being true.
Free, no integration required, five design-partner places open
| Value date | Narration | Credit | Balance |
|---|---|---|---|
| 11-JUN-2026 | SMS ALERT CHARGE | — | 419,405.22 |
| 13-JUN-2026 | POS SHOPRITE IKEJA | — | 412,905.22 |
| 18-JUN-2026 | SALARY JUN 2026 · PAYROLL | 245,000.00 | 457,905.22 |
| ↳ recomputed from row above | 657,905.22 | ||
| 22-JUN-2026 | NIP TRF TO ADEBAYO K | — | 445,605.22 |
| 28-JUN-2026 | ACCOUNT MAINTENANCE | — | 445,505.22 |
ARITH_RUNNING_BALANCE_BREAKCredit on row 14 is ₦200,000.00 higher than the balance chain supports. Every row after it still follows the original figure.FONT_INCONSISTENT_EMBEDDINGAmount glyphs on row 14 render from a different font instance than the rows above and below.The arithmetic
Nobody knows their statement-fraud number. That's the problem.
Undetected document fraud doesn't arrive labelled. It shows up months later as ordinary first-payment default. Put your own figures in and see the size of what you may not be measuring.
Estimated monthly exposure
₦51,300,000
Principal advanced against documents that would not survive a ledger recompute.
- Over twelve months
- ₦615,600,000
- Loans slipping through monthly
- 114
- Documents reviewed monthly
- 5,000
- Vepiom Growth
- $899 / mo
These are your assumptions, not our claim. We publish this calculator because the honest answer to "how much statement fraud do you have?" is that nobody knows until someone re-examines the documents. That is exactly what the free audit does — on your real files, with real numbers.
What we detect
Seven ways a bank statement lies
Manipulation isn't one thing, so detection can't be one model. Each class leaves a different trace, and needs a different check. Any vendor selling you a single AI score is strong on two of these and blind to the rest.
| Class | What the applicant did | How we catch it |
|---|---|---|
| A | Edited a real statementChanged a figure in place, deleted an inconvenient row, or laid a new number over the old one. | File-structure forensics Ledger recompute |
| B | Rebuilt it from a templateRetyped the whole statement, so there is no original to compare against. | Issuer template conformance Field grammar checks |
| C | Printed and rescanned itFlattened the file to images specifically to destroy the evidence editing leaves behind. | Image forensics Ledger recompute |
| D | Fabricated it outrightGenerated a statement for an account that never behaved that way, increasingly with AI tooling. | Behavioural plausibility Cross-lender fingerprints |
| E | Used somebody else's statementA completely genuine document. It just isn't theirs. | Name and account linkage |
| F | Manufactured the behaviourCycled the same money in and out to inflate turnover, or parked a deposit until the statement closed. Nothing was forged. | Round-trip detection End-window balance analysis |
| G | Edited each month separatelySubmitted six statements and forgot that month four has to end where month five begins. | Cross-document reconciliation |
Class F matters more than it looks. Nothing is forged, so no forensic check can see it — and a direct open-banking feed shows the same manufactured behaviour. It is the part of this problem that does not go away.
How it works
Nine checks, in order, every document
Deterministic and explainable first, statistical last. When your credit committee asks why a document was flagged, the answer is a row number and an amount — not a model's intuition.
L0
Ingest
Detect the true file type, render every page, identify the issuing bank and the statement variant. Untrusted files are parsed in isolation with no network access.
L1
File structure
Generation history, producer fingerprint, embedded fonts, text geometry, image objects. Every signal calibrated per bank against genuine documents first.
L2
Image forensics
Compression history, local noise and sharpness breaks, duplicated pixel blocks, per-line skew. The only forensic layer available once a file has been flattened.
L3
Template conformance
Margin geometry, column offsets, footer wording, reference-ID grammar, the periodic charges a real account always accrues. Versioned per bank, per era.
L4
Ledger recompute
The running balance chain, period reconciliation, summary-block agreement, page carry-forward, date order, duplicate rows. Ten checks, no machine learning, fully explainable.
L5
Behaviour
Round-tripping, turnover against average balance, end-of-window spikes, salary regularity and originator type, counterparty concentration, existing loan obligations.
L6
Network
Anonymous document and layout fingerprints matched across every institution using Vepiom. A forgery family caught at one lender protects the rest. Derived data only — never your customers' details.
L7
Provenance
Where the applicant forwards the bank's original email, we verify the signature covers the attachment unchanged. That is close to proof, not probability.
L8
Score and evidence
A calibrated score, ordered reason codes with page and region for each, a plain-language summary for the credit file, and an honest statement of what could not be checked.
Three answers, not one number
Route by assurance, not by gut feel
Every document comes back in one of three tiers, so your workflow can branch on it directly. Thresholds are yours to set — a ₦50,000 payday loan and a ₦40,000,000 asset facility should not share a cut-off.
Verified
Provably unmodified
The issuing bank's own signature covers this exact file. There is no meaningful integrity question left to ask. Route straight through.
Consistent
Nothing failed
Every check we could run on this issuer passed. The coverage field tells you precisely which ones ran, so a clean result is never a silent one.
Suspect
Signals present
Ordered reason codes with the page, the region and the amount. Your reviewer opens the document already knowing where to look.
For engineers
One endpoint. Async. Fails open.
Post a file, get a webhook. If we are slow or down, your decisioning continues on whatever process you use today — we are never in a position to block a disbursement.
POST /v1/documents Authorization: Bearer sk_live_… Idempotency-Key: app_88213_stmt_1 file: statement_jun2026.pdf applicant_name: "Adewale J Okoro" account_number: "0123456789" expected_period: "2026-01-01/2026-06-30" webhook_url: "https://you.example/hooks"
{
"risk_score": 78,
"assurance_tier": "suspect",
"issuer": { "detected": "GTBANK_NG" },
"coverage": {
"layers_run": ["L1","L3","L4","L5","L6"],
"layers_skipped": ["L7: no_email_provenance"]
},
"reason_codes": [{
"code": "ARITH_RUNNING_BALANCE_BREAK",
"severity": "critical",
"page": 3, "row": 14,
"expected_minor": 65790522,
"stated_minor": 45790522
}],
// no "approved" field. that call is yours.
}
Where we draw the line
A false flag denies a real person credit
That asymmetry shapes the product. We would rather stay quiet than be confidently wrong, and there are things we will not build even when asked.
We won't
Return a decision
No approve field, no decline field, ever. You get evidence and a score. Inheriting your credit decision would mean inheriting responsibility for it, and that belongs with your risk team.
We won't
Hide a blind spot
If we have no template for an applicant's bank, the response says so. A clean score built on checks that never ran is worse than no score at all.
We won't
Keep your documents
Source files are deleted on a hard 72-hour timer, or sooner if you prefer. What remains is derived signals and anonymous fingerprints. The network layer never carries names, accounts or transactions.
We won't
Power a blacklist
Fingerprints tell you a document has been seen elsewhere. They never identify the applicant or the institution. If you want to auto-reject people across lenders with no review and no appeal, we are the wrong supplier.
We will
Publish our false-positive rate
Per bank, to every customer, including when it moves the wrong way. You cannot set a sensible threshold against a number a vendor won't show you.
We will
Give the applicant a route back
A flag should be answerable. Ask them to forward the bank's original email and provenance verification settles it in minutes, without a branch visit.
Pricing
Priced per document, against a loss you can measure
A platform fee plus usage. No implementation fee, no minimum term below Enterprise, and the audit that gets you here costs nothing.
Starter
$249 / mo
1,500 documents included · $0.18 after
- All nine check layers
- Reviewer console
- Email support
Growth
$899 / mo
7,500 documents included · $0.14 after
- Cross-lender fingerprint network
- Per-bank false-positive reporting
- Threshold tuning on your own history
- Shared Slack channel
Scale
$2,900 / mo
30,000 documents included · $0.10 after
- Payslip and utility-bill checks
- Custom reason-code weighting
- Uptime commitment
Enterprise
Talk to us
Banks and regulated lenders
- In-country or private-cloud deployment
- Data residency by region
- Security review and DPA
Design partner programme · five places
We'll audit your last 500 applications. Free.
Send historical files — including the ones that defaulted. You get a written report naming specific suspect documents with the evidence, and default rate broken down by risk band. No integration, no engineering time, no obligation.
- Send the files200 to 500 historical applications with outcomes, over a secure transfer we set up for you.
- We analyse themEvery layer, on your real documents, against the templates for your applicants' actual banks.
- You get the reportNamed documents, the evidence for each, default rate by band, and an honest note on what we could not check.
- You decideIf it found nothing, we tell you plainly and you have learned something for free.
Questions
The things risk teams ask first
Does Vepiom decide whether to approve a loan?
No, and we won't. You get evidence and a calibrated score with ordered reason codes. Your team makes the call. We also ask customers not to auto-decline on score alone, and we say so in the integration guide rather than burying it in a contract.
How long do you keep uploaded statements?
Source documents are deleted on a hard 72-hour timer by default, and you can set it shorter. After deletion we hold derived signals, the extracted figures you asked for, and anonymous fingerprints. Backups follow the same clock.
Do you replace open banking?
No. Pull data directly from the bank wherever you can get consent — it's better data. Vepiom covers the applications that fall back to file upload, which in most markets is a large share. It also catches manufactured account behaviour like round-tripping, which a direct feed reports just as faithfully as a genuine pattern.
What if you haven't seen an applicant's bank before?
You still get file-structure forensics, the full ledger recompute, behavioural checks and network signals. What you lose is issuer template conformance. The response's coverage field states exactly which layers ran and which were skipped, so you are never handed a clean score resting on checks that never happened.
How is the free audit different from a trial?
There is nothing to integrate and no engineering time involved. You send historical applications, we analyse them and return a written report. A trial asks you to spend a sprint wiring up an API to find out whether the problem exists. The audit answers that question first.
Do you need a licence or government approval?
No. We process documents your own applicants gave you, on your instructions, as your data processor. No regulatory licence, no agency integration, no procurement committee. We sign a standard data processing agreement and support your NDPA and GDPR obligations, including in-region processing where a regulator requires it.
What accuracy should we expect?
It depends on the bank and the manipulation class, so a single headline number would be misleading. We report recall per class and false-positive rate per issuer, we show you both during the audit, and we keep publishing them after you sign. Where a layer is weak — image forensics on flattened files is the honest example — we say so and weight it accordingly.
Where does Vepiom operate?
We're built in Lagos and starting with Nigeria, Kenya, Ghana and Egypt, because that is where statement uploads still decide most credit and where template coverage barely exists. The engine is not region-specific; if your applicants bank somewhere else, tell us which institutions and we'll tell you honestly what coverage looks like.