IDIKSA is an individualized digital indicator of knowledge, of skills and abilities, which should become a generally accepted and directing tool in a world based on the integration of physical and virtual spaces.
Kostenko Oleksii V.,
State Scientific Institution “Institute of Information,
Security and Law of the National Academy of
Legal Sciences of Ukraine”, Ukraine, (corresponding author)
ORCID 0000-0002-2131-0281
Oleh Burdeinyi
Originator of the project to create the international scientific and practical cluster “SHIELD (Scientific Hub for Integrity and Economic Law Defense),” ORCID: 0009-0001-2364-5157
Oleksii Patsarniuk
Private Higher Education Institution “Kamianets-Podilskyi Tax Institute,
” Kamianets-Podilskyi, Ukraine, ORCID: 0009-0005-9287-2643
Abstract
Corruption risks in public administration increasingly span institutional processes, corporate networks and digital assets. This article develops SHIELD, a research infrastructure that connects the analysis of processes inside EU institutions and bodies, verifiable data and procedurally usable expert work for competent authorities such as OLAF, the EPPO, Europol and Financial Intelligence Units (FIUs). Based on a targeted review of 103 legal, institutional and scientific sources verified as of 11 October 2026, the study specifies a common risk methodology, a data and analytics programme (transparent indicators, entity resolution, network analysis, calibrated machine learning and language models) and validation protocols that separate legal admissibility, statistical performance and causal effect. The framework is then extended to Web 4.0 and metaverse environments, where benefits can be transferred as crypto-assets, non-fungible tokens, virtual land or DAO disbursements. A three-tier regulatory mechanism of prevention, deterrence and blocking is proposed, centred on a blockchain-anchored AI Transaction Commissioner deployed at regulated gateways. The Commissioner screens high-risk cross-border transactions, applies graded and time-limited measures (pass, hold, provisional block) under thresholds bound by human review capacity, and escalates to FIUs, which retain statutory suspension powers. Safeguards under the GDPR, the AI Act, MiCA and the Transfer of Funds Regulation are mapped. Governance, four pilots, a 30-month work plan and an illustrative budget are presented, together with a synthetic simulation of the precision–workload trade-off. A risk signal is treated as a ground for further review, never as a finding of wrongdoing.
Keywords:
Corruption risk; EU institutions; Web 4.0; Metaverse; Blockchain; AI Transaction Commissioner; Anti-money laundering
Corruption in public administration is rarely visible as a single event. It appears as a chain of decisions, relationships and payments that are individually explicable but collectively anomalous. The European Union (EU) has built a dense institutional architecture to address this problem: the European Anti-Fraud Office (OLAF), the European Public Prosecutor’s Office (EPPO), Europol, Eurojust, national Financial Intelligence Units (FIUs) and, since 2024, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) [1–5]. The new Directive (EU) 2026/1021 on combating corruption further harmonises criminal-law definitions and preventive duties [6]. Yet the European Court of Auditors continues to report insufficient information exchange, uneven use of analytical tools and data limitations [7,8].
Two developments make the problem more acute. First, analytical capacity has grown faster than the methodological discipline needed to use it: procurement risk indices, network analysis and machine learning (ML) are available, but their validity outside the setting in which they were developed is often unknown [9–12]. Second, value transfer is migrating into Web 4.0 and metaverse environments, where crypto-assets, non-fungible tokens (NFTs), virtual land and decentralised autonomous organisations (DAOs) allow economic benefits to cross borders in seconds and outside traditional banking channels [13–16]. A bribe no longer needs to be an envelope or a wire transfer; it can be an over-priced virtual parcel, a DAO grant or an in-world service payment between avatars [17–19].
This article develops SHIELD (Scientific Hub for Integrity and Economic Law Defence) as a networked research consortium of universities, legal experts, RegTech and GovTech developers and specialists of competent authorities. The central objective is to improve the prevention and verification of corruption risks by connecting institutional analysis, verifiable data and procedurally usable expert work. The primary object of analysis is processes inside EU institutions, bodies, offices and agencies: procurement, grant awarding, decision preparation, disclosure of interests, staff mobility and internal control. Spending of EU funds by national implementing bodies is treated as a related but distinct domain, because it changes the applicable law, data sources, responsible persons and addressees of analytical products [20,21].
The article makes four contributions. (i) It specifies a common methodology for assessing corruption risk that separates legal admissibility, statistical performance and causal effect. (ii) It defines a data and analytics programme—indicators, entity resolution, networks, ML and language models—with explicit validation protocols. (iii) It proposes a regulatory mechanism for Web 4.0 environments, centred on a blockchain-anchored AI Transaction Commissioner (AI-TC) that autonomously screens high-risk cross-border transactions and applies graded, time-limited measures under human and judicial oversight. (iv) It sets out governance, pilots, a 30-month work plan and a budget scenario. The Web 4.0 component builds on the author’s prior work on electronic and digital jurisdiction, cross-border metaverse models and identification data [22–28].
The article is a conceptual study and research-programme design. It reports no proprietary case data and no results of SHIELD deployment; all efficiency, cost and simulation figures are illustrative. References to authorities do not imply confirmed partnership or access to their systems. Legal and source verification was performed as of 11 October 2026. Fig. 1 summarises the framework.
Fig. 1. Conceptual overview of the SHIELD framework: inputs, methods, controls (including the AI Transaction Commissioner for Web 4.0 transactions) and outputs for competent authorities.
The remainder is structured as follows. Section 2 sets out the conceptual and legal background. Section 3 describes materials and methods. Section 4 presents the SHIELD analytical framework. Section 5 develops the Web 4.0 mechanism. Section 6 addresses legal safeguards. Section 7 describes implementation. Section 8 discusses the findings and limitations, and Section 9 concludes.
For SHIELD, corruption risk is defined as the likelihood and consequences of the misuse of entrusted power for private gain in a specific process. This is a working analytical definition. Legal qualification follows the applicable law, taking into account the elements of the offence, intent, the status of the person and jurisdiction; the UN Convention against Corruption is the international reference point [29]. Table 1 distinguishes the categories that analytical outputs must not conflate.
Table 1
Analytical categories and what must be established before legal qualification
The same fact may have several explanations. A single bidder may reflect a narrow specialised market, urgency, a publication defect or artificial restriction of access. Corporate links may be lawful and disclosed. Analytical cards must therefore preserve alternative explanations until they are checked. Base units of analysis are the procedure, contract, payment, grant decision, official act, control measure and—in Web 4.0 environments—the individual on-chain or in-world transaction. Persons and organisations appear as participants in events; no general personal integrity score is produced. Expert scores without calibration are labelled as review priority, not as a probability of corruption, and arbitrary multiplication of ordinal scores is avoided because it does not yield a measurable expected loss.
SHIELD’s addressees differ in legal status, tasks and data-processing bases (Table 2). Europol supports law-enforcement cooperation without coercive powers of its own; INTERPOL provides international police cooperation outside the EU institutional system; the EPPO investigates and prosecutes offences against the EU’s financial interests within its competence; FIUs receive and analyse financial information; OLAF and AMLA perform administrative and coordination functions [1–4,30–34]. Eurojust, the European Court of Auditors, internal auditors and the European Ombudsman use results within their own remits; the EDPS and national data-protection authorities are regulators, not data sources.
Table 2
Competent addressees and possible SHIELD products
A memorandum of understanding expresses organisational intent but does not by itself create a legal basis to disclose data or to access SIENA, FIU.net or INTERPOL systems. SHIELD keeps a register of authorised assignments (requesting body, purpose, competence limits, data, confidentiality regime, responsible expert and permitted recipients) and transmits results to the addressee, which alone decides on further action.
Protection of the EU’s financial interests connects financial rules, criminal law and administrative investigations. Directive (EU) 2017/1371 defines PIF offences and Regulation (EU) 2017/1939 establishes EPPO competence, which requires material, territorial and personal links; not every corrupt act within European public administration falls to the EPPO [1,35]. Directive (EU) 2026/1021 was adopted on 29 April 2026, published on 11 May and entered into force on 31 May 2026; core national measures are due by 1 June 2028, and measures under Articles 20(5) and 21 by 1 June 2029 [6]. Entry into force does not mean completed transposition.
The AML package and the crypto-asset regime are decisive for the Web 4.0 component (Table 3). Regulation (EU) 2023/1114 (MiCA) licenses crypto-asset service providers (CASPs); Regulation (EU) 2023/1113 (TFR) extends the “travel rule” to crypto-asset transfers and obliges CASPs to apply risk-based procedures to execute, reject, return or suspend transfers lacking required information [36–38]; DAC8 adds tax reporting on crypto-asset transactions [39]. FATF Recommendations 15 and 16 and the virtual-asset guidance set the international baseline [34,40,41].
Table 3
Status of key EU instruments at the date of the study and implications for SHIELD.
Timelines follow the legal acts and AMLA’s official explanations [4,31–33]. Politically exposed person (PEP) status is used for prescribed risk assessment and enhanced measures; by itself, PEP status, nationality, family ties or presence in a commercial database does not indicate an offence [42].
A digital programme must account for existing infrastructure (Table 4). According to the Commission, the transition to Arachne+ began in 2026, with a full version and readiness assessment planned by the end of 2027; these plans do not confirm data completeness or algorithmic effectiveness [43].
Table 4
Existing EU control systems and their place in SHIELD research.
The public EDES lists only published measures; IMS reflects detected and reported cases; FTS and TED do not automatically provide full observation of all expenditure and decisions [44–47]. SHIELD’s added value lies in a common observation specification, reproducible evaluation protocols, methods for analysing internal processes and—new in this article—a validated bridge between procurement analytics and Web 4.0 transaction monitoring. Where a public tool already solves a task, SHIELD offers an independent test protocol rather than a competing product.
The study combines a targeted review of primary sources with design-science development of a research programme and a regulatory mechanism. Searches covered EUR-Lex, websites of EU bodies and international organisations, publishers’ platforms and university repositories, using thematic queries on corruption risk, public procurement, financial intelligence, crypto-asset regulation, metaverse governance, data protection, algorithm evaluation and causal effects of controls. Priority was given to legal texts in force, official audits and original research. The resulting corpus comprises 103 sources, each linked to a specific section (Fig. 2). Legal documents were checked for scope and application dates; scientific works for design, outcome type and transferability limits. The review is not an exhaustive systematic search, and no meta-analysis was performed.
Fig. 2. Composition of the source corpus by type (n = 103).
Five testable hypotheses structure the programme (Table 5). H1–H4 originate in the institutional SHIELD programme; H5 addresses the Web 4.0 mechanism.
Table 5
Research questions, hypotheses and tests.
Legal admissibility, statistical performance and causal effect are assessed separately. An algorithm may rank historical cases well and still be unsuitable in another jurisdiction; a lawfully obtained dataset may be unrepresentative; shorter review time does not prove prevented harm. Each conclusion states the observation that could refute it. Protocol pre-registration includes population, unit of analysis, primary outcome, exclusion rules, features available at decision time, data splitting and analysis plan; later changes are dated and justified, and modified analyses are labelled exploratory. Limitations include the hidden nature of corruption, incomplete open data, selective investigations and long court proceedings. Early studies therefore assess the quality of confirmed signals and control work; claims about prevalence or economic effect require dedicated designs.
The primary research perimeter covers EU institutions and bodies as contracting authorities, resource managers and participants in public governance. An agency’s internal procurement and a national contract under shared management cannot be analysed as one legal regime [20,21]. Table 6 maps vulnerable events and controls; it does not assume that such events are common in a given body.
Table 6
Process map: risk events, observation and prevention.
A high number of reports in a unit may indicate trust in the reporting channel; a low number may reflect fear, lack of information or genuine absence of breaches. Recorded cases are interpreted together with activity volume, recording completeness and control intensity. Each process receives a passport: owner, legal regime, decision population, value or significance, available data, controls, known limitations and evaluation plan.
Datasets are built around a research question. The open stage uses TED notices, FTS data, authorised corporate registers and public documents; the closed stage may include internal minutes, execution data and financial analysis only where access and legal basis are established. TED offers an API and XML bulk downloads, with eForms and legacy schemas coexisting [47]; the unit of analysis is the procedure or contract, not an individual notice file. Each dataset carries a passport following Datasheets for Datasets [48], extended with jurisdiction, access regime and provenance of every material transformation; each version receives an immutable identifier, query parameters, extraction date, checksums and processing code.
Table 7
Data-quality dimensions, checks and responses.
A quality report is published in permissible form before models are compared, so that high metrics cannot conceal source defects (Table 7). Missing values are a research problem in their own right: an unrecorded field may depend on institution type or period, so mean imputation can create artificial differences. Analyses include sensitivity scenarios and explicit “unknown” categories. If minimum observability of a process is not reached, improving recording takes priority and predictive modelling is postponed.
Corporate and personal links have analytical value only after identity verification. Matching starts with reliable legal-entity identifiers (register number with jurisdiction and period, verified tax number, LEI), then normalised names and addresses with original values preserved; fuzzy similarity only generates candidates. Automatic merging of records on natural persons is permitted only under pre-justified conditions with sufficient accuracy and lawful processing. False merges and missed matches are measured separately because they distort networks differently. Table 8 states what each link supports.
Table 8
Link features: permissible and impermissible inferences
The Court of Justice invalidated unrestricted public access to beneficial-ownership information in 2022 [49]; Directive 2024/1640 provides access for persons with legitimate interest, including research categories in a defined context, subject to national procedures [32]. Scientific status does not entail free access to all registers. Ownership history is modelled in time; a link that appeared after an award is not projected back into a past prediction
An indicator describes an observable deviation and the rule for computing it. Procurement risk indices demonstrate that such operationalisation is feasible [9,50]. SHIELD uses a small transparent indicator set (Table 9), compared within suitable groups (procurement type, CPV sector, value, period, institutional regime, market structure). Thresholds may be quantiles or transparent rules and are tested for sensitivity and downstream review load.
Table 9
Selected indicators, lawful explanations and additional checks.
A composite score is used as a review-priority index; its components, weights and available data are shown to the user. A missing feature is not equated with a safe value. Retroactive threshold changes to improve a metric are prohibited by protocol. Analyst feedback (lawful explanation, technical error, insufficient data, justified referral) improves the procedure but does not automatically become a training label.
Network analysis examines recurring relationships among contracting authorities, suppliers, experts, intermediaries and decisions; work on state capture demonstrates its value [51], and graph-based anomaly detection is well established in fraud research [52]. In SHIELD the graph is a structure of verifiable events: vertices are entities; edges are documented relations with type, time and source. Distinct relations are never merged into a generic “link”. Centrality may reflect size or lawful specialisation, so unusualness is assessed against comparable markets and a null model that preserves meaningful constraints. Robustness checks remove uncertain matches, use historical snapshots, compare with null models and verify individual documents
Table 10
Robustness checks for network analysis.
Visual proximity of vertices does not establish intent; pseudonymised graphs may remain identifying through structure, so access is task-restricted and demonstrations use synthetic networks. A graph module is useful only if it yields additional confirmed results at comparable manual-review cost.
ML is applied to a pre-defined outcome—confirmed documentation defect, additional review or an established type of breach—never to a generic “corruption” label. Historical investigations are selective, so the absence of a case is not a negative example; an independent check of a sample of unflagged cases is required. Table 11 and Fig. 3 illustrate the base-rate effect for a hypothetical population of 10 000 objects with 100 positives and sensitivity of 95%.
Precision is and recall . With rare outcomes, even high sensitivity produces many false alerts; therefore precision–recall, calibration, precision among the first k signals and analyst workload are reported, with ROC AUC as a secondary metric [53]. The same arithmetic governs the AI-TC in Section 5, where false positives translate into blocked lawful transactions.
Fig. 3. Share of true signals (precision) as a function of specificity at sensitivity 95% for three prevalence levels. Markers show the two cases in Table 11.
Training uses an earlier period and final testing a later one, with transfer tests across bodies or countries. Related contracts and participants are grouped when splitting data. Leakage—inclusion of later audit results, future register entries or investigation consequences—is prevented through a temporal feature catalogue and independent code review [54]. Comparisons include random selection, existing rules, simple regression and the more complex model; interpretable models are preferred where performance is comparable [55]. Confidence intervals account for dependence and label uncertainty.
Text methods can locate changes in criteria, extract roles and dates, compare contract versions and draft chronologies across EU languages. Retrieval-augmented generation reduces dependence on model memory but does not guarantee truthfulness. Every material statement in a draft is checked by an analyst against the source fragment; the card records model version, query parameters, corpus and source. External documents are treated as untrusted data: embedded instructions must not alter access rights or trigger actions. Generative-AI risks are addressed following NIST and EDPS guidance [56,57], and model cards document purpose, limits and metrics [58].
Table 12
Text-analytics scenarios, metrics and limits
Tests include negation, ambiguous roles, long annexes, poor OCR and terminological differences across legal systems (Table 12). Access control applies to the search index, retrieved fragments and query logs alike. Before a model is admitted to the working environment, the provider, retention of queries, training on input material and cross-border transfer are reviewed separately. Text modules are not used for automatic legal qualification or conclusions on guilt.
Digital search for procurement anomalies covers only part of the task. Internal procedures include disclosure of interests, recusal, authorisation of outside activities, post-employment conditions, meeting records and handling of reports. The Commission describes staff duties on independence and disclosure, post-service restrictions and IDOC functions [59]; the Transparency Register governs certain interest representation [60]. OECD treats risk management and internal audit as elements of a public-integrity system [61,62]. Table 13 sets out measurable indicators.
Table 13
Internal integrity mechanisms and indicators.
An increase in the number of declarations can be a desirable behavioural change and must not be read as rising corruption. SHIELD separates the process owner (remedies defects), the analytics developer and an independent evaluator.
SHIELD is designed as a modular environment separating a research perimeter from agency perimeters (Fig. 4). The shared infrastructure holds open data, documentation, authorised training sets and versioned components; restricted data are processed in the owner’s isolated environment or a specifically authorised project environment. For the first version, an open corpus is combined with containers for local evaluation on closed data: a container receives signed code and a defined list of operations, and outputs are checked by the owner before release.
Fig. 4. Layered SHIELD digital architecture and control boundaries (L1–L7).
The main work object is the analytical card linking observation, source, check and decision on further transmission. Its states—signal received, data verified, explanations assessed, material prepared, transmitted or closed—are approved by named roles. For each source, an authorised copy or address, retrieval date, version identifier and checksum are stored. A checksum detects modification after recording; it does not prove the truth of content or the lawfulness of acquisition. Anchoring these checksums in a permissioned blockchain ledger provides tamper evidence across institutions without a single trusted custodian [63,64]; it does not confer automatic admissibility in court. The EPPO assesses competence and sufficiency of reports itself [65]; SHIELD prepares clearly structured material and explains calculations but has no investigative or coercive mandate; exculpatory evidence and alternative versions are recorded alongside incriminating information, consistent with the presumption of innocence and OLAF’s procedural guarantees [66,67].
The Commission’s Web 4.0 initiative anticipates an integration of digital and real objects and environments, with virtual worlds becoming a significant venue for economic activity [13]; the European Parliament has called for attention to the risks of virtual worlds for the single market [14]. Metaverse platforms combine persistent virtual spaces, avatars and tokenised assets on distributed ledgers [68–70]. Law-enforcement assessments describe crimes migrating into metaverse settings and the forensic difficulty of attributing avatars, wallets and assets to persons [15,16]. Empirical research shows that a material share of crypto-asset activity has historically been associated with illicit use and that regulatory responses follow a dialectic of adaptation [19,71,72].
From a corruption perspective, Web 4.0 introduces four vulnerabilities. (i) Value disguise: a benefit can be transferred as an NFT, virtual land or in-world service priced off-market. (ii) Identity dissociation: an avatar or pseudonymous wallet separates the beneficiary from the official. (iii) Speed and composability: cross-chain bridges and smart contracts move value through multiple hops in minutes. (iv) Jurisdictional fragmentation: the transaction, platform operator, CASP and parties may sit in different legal orders. The author’s earlier work describes this fragmentation and proposes digital (electronic) jurisdiction as a post-territorial institute that attaches legal consequences to protocols, identities and platform operators rather than solely to territory [22–26,73]. Related work has outlined a model criminal code for the metaverse and the legal status of blockchain records and AI agents in virtual environments [17,18,70,74].
The existing EU framework provides building blocks—CASP licensing, the travel rule, FIU suspension powers, the European Digital Identity Wallet and smart-contract requirements under the Data Act [32,36,37,75,76]—but no mechanism that connects corruption-risk intelligence from public-procurement and integrity processes with real-time control of cross-border virtual-asset transfers. Section 5 closes this gap.
5.2. Corruption-risk attributes of Web 4.0 transactions
Table 14 operationalises corruption-risk attributes as observable signals with legal hooks and lawful explanations. Fig. 5 expresses their relevance across transaction typologies as an expert assessment by the author; it is a hypothesis to be tested in the sandbox, not an empirical estimate.
Table 14
Corruption-risk attributes in Web 4.0 transactions.
Fig. 5. Expert-assessed relevance of corruption-risk attributes across Web 4.0 transaction typologies (author’s hypothesis for sandbox testing).
The proposed mechanism operates at three levels of intervention.
Prevention (ex ante). (a) Verified digital identity: transfers above a threshold at regulated gateways require an EUDI-wallet-based attestation or the cross-border personalised ID-code proposed for avatars and electronic personalities [27,28,75]; zero-knowledge proofs allow a party to prove eligibility (e.g., “not a sanctioned person”, “funds of declared origin”) without disclosing underlying data [77,79]. (b) Extension of asset declarations of EU and national officials to crypto-assets, NFTs and virtual property, with machine-readable wallet disclosure to the competent ethics body. (c) Compliance-by-design smart contracts for public grants and procurement payments disbursed in tokenised form, with conditions, escrow and audit hooks consistent with the Data Act’s essential requirements for smart contracts [76,80].
Prevention also depends on the choice of ledger. Public permissionless chains offer global verifiability but expose transaction graphs; permissioned ledgers operated by supervisory authorities and regulated gateways allow access control and the right to erasure to be respected by storing only hashes on-chain and personal data off-chain [63,64]. SHIELD therefore recommends a hybrid design: personal data and analytical cards remain in controlled stores, while their cryptographic fingerprints, model versions and decision timestamps are anchored in a permissioned ledger, periodically checkpointed to a public chain for independent verifiability.
Deterrence and prophylaxis. (a) A permissioned audit ledger where each control decision, model version and reviewer action is hash-anchored, making later concealment detectable [63,64,81]. (b) Cooling-off rules: officials involved in an award are subject to a defined period during which virtual-asset inflows from linked parties trigger automatic review. (c) Publication of aggregated, privacy-protected statistics on holds and blocks to signal detection capacity without exposing individuals.
Blocking. Graded, time-limited measures executed by the AI-TC at regulated gateways and escalated to the FIU, which retains the statutory power to suspend or withhold consent to a transaction [32]. Definitive freezing or confiscation remains with competent authorities and courts.
The AI Transaction Commissioner is defined here as a legally mandated, supervised algorithmic agent embedded at the gateway layer of Web 4.0 environments—authorised CASPs, platform operators of virtual worlds and cross-chain bridges with an EU nexus—which autonomously screens cross-border transactions in real time, assigns a risk tier with reasons, and executes graded provisional measures within a mandate fixed by law. It is a commissioner in the legal sense of a delegated function with defined powers, accountability and review, not an autonomous legal subject; this follows the author’s graduated model of AI legal subjectivity and AI representatives of public authorities [82,83]. Fig. 6 shows the architecture.
Fig. 6. Architecture of the AI Transaction Commissioner (AI-TC): gateway, risk engine, decision tiers, oversight and audit ledger.
The risk engine combines four modules. Hard rules cover sanctioned addresses, listed high-risk jurisdictions and non-compliant mixing services [40,78]. On-chain graph analytics detect peel chains, rapid hops and bridge patterns; graph neural networks have shown promise on labelled Bitcoin data [84], but transfer to other chains must be validated. Off-chain context adds PEP and declaration data and, uniquely, links from SHIELD procurement analytics (Section 4), so that an inflow to an official shortly after an award to a related supplier becomes visible. A calibrated model outputs a score with feature attributions and counterfactual explanations [85,86]. The decision rule is:
where is mean review time per held transaction, the daily analyst capacity, the false-block rate among RED decisions and a ceiling set in advance by the supervisor. Calibration is an admission criterion: the expected calibration error must not exceed a pre-registered value on a temporally held-out set. Table 15 sets out the graded measures and Fig. 7 the escalation timeline.
Table 15
Graded measures of the AI Transaction Commissioner.
Fig. 7. Escalation timeline of AI-TC measures from initiation to statutory decision and remedy.
Table 16 distributes responsibility. The design follows Lessig’s insight that code regulates behaviour [87] but places the code under law: the gateway executes, the supervisor sets thresholds, the FIU decides on suspension and courts review.
Table 16
Distribution of roles and accountability around the AI-TC.
The AI-TC targets transactions with high cross-border risk because these combine jurisdictional fragmentation and weaker information exchange. Interoperability with third countries relies on the travel-rule message standard and FATF R.16 [34,38,41]. For Ukraine, as an EU candidate country, alignment of the Law “On Virtual Assets” with MiCA and the TFR [36,37,89] is a precondition for mutual recognition of AI-TC decisions; the author’s model of a typical cross-border metaverse proposes protocol-level jurisdictional markers that could serve as attachment points [23,24]. Public-sector cooperation experiments such as BIS Project Aurora demonstrate privacy-preserving cross-institution analytics for money laundering, supporting the federated design adopted here [90].
To illustrate the trade-offs in Eq. (2), a synthetic population of 100 000 transactions with 1% risk-tainted cases was generated (scores drawn from Beta distributions; , ). Fig. 8 shows the distribution. RED captured 178 transactions, of which 173 were risk-tainted (precision 97.2%); AMBER captured 1 889, of which 574 were risk-tainted (30.4%); 253 risk-tainted transactions (25.3%) passed as GREEN. The review load was 2.1% of traffic. These numbers result solely from the assumed distributions and demonstrate the mechanism, not the performance of any real system.
Fig. 8. Illustrative synthetic simulation of AI-TC scores (100 000 transactions, 1% risk-tainted) with AMBER and RED thresholds. Not an empirical result.
Five safeguards are indispensable. (i) Legal basis for automated decisions: a provisional block significantly affects the person and therefore requires authorisation in Union or Member State law with suitable safeguards under Art. 22 GDPR [91]. (ii) Prohibited practices: the AI-TC scores transactions, not personality traits, and must not predict criminal behaviour of natural persons based solely on profiling [92]. (iii) Human oversight and explanation: AMBER and RED decisions carry reasons that a reviewer can contest; counterfactual explanations indicate what would change the outcome [85]. (iv) Proportionality: holds are time-limited and default to release; the false-block ceiling is binding. (v) Model governance: the system is managed under an AI management system, documented by model cards, red-teamed against evasion and subject to a sunset-and-review clause [58,93]. Because automation at scale magnifies the base-rate problem (Section 4.5), the AI-TC is admitted only after a sandbox evaluation demonstrates H5.
To make the mechanism legislatively operational, the following model provisions are proposed for an EU instrument or for national implementing law (including Ukraine’s alignment with the EU acquis). They are drafted at the level of principles and require adaptation to the legal order concerned.
Article 1 (Mandate). An AI Transaction Commissioner may be deployed by an authorised crypto-asset service provider, a platform operator of a virtual world or a cross-chain bridge operator with an establishment or significant activity in the Union, for the sole purpose of preventing, detecting and provisionally interrupting transfers presenting a high risk of corruption, money laundering or fraud affecting public finances.
Article 2 (Graded measures). The Commissioner may (a) execute a transfer; (b) hold it for enhanced verification for no longer than 24 hours; or (c) provisionally block it for no longer than 72 hours pending a decision of the Financial Intelligence Unit. In the absence of a decision within these periods, the transfer shall be released.
Article 3 (Thresholds and oversight). Risk thresholds, the maximum false-block rate and the list of hard rules shall be approved by the competent supervisory authority, published in aggregate form and reviewed at least annually. Every hold or block shall be reviewed by a natural person with the competence and authority to override it.
Article 4 (Reasons and remedies). The person concerned shall, where this does not prejudice an investigation, be informed of the measure, its main reasons and the available remedy. Decisions shall be subject to administrative review and judicial control, and damages shall be available for unlawful blocks.
Article 5 (Prohibitions). The Commissioner shall not assess personality traits, shall not produce general integrity scores of natural persons and shall not take definitive measures of freezing or confiscation.
Article 6 (Records and audit). All decisions, model versions and reviewer actions shall be recorded in a tamper-evident ledger accessible to the supervisory authority, the data-protection authority and the courts. The system shall be independently evaluated before deployment and every two years thereafter, and shall cease to operate unless renewed following evaluation.
Processing law is determined by purpose, data category and the status of the participant. For research processing, the GDPR applies within its scope; processing by national competent authorities for law-enforcement purposes is governed by Directive 2016/680; EU institutions apply Regulation 2018/1725, with special regimes for operational data of agencies [1,2,91,94,95]. Pseudonymised data remain personal where re-identification is possible. Article 89 GDPR safeguards do not replace an independent legal basis; offence data require Article 10 and special categories Article 9; a data-protection impact assessment is carried out where high risk exists [91]. Before upload, fields and operations are approved; where an aggregate suffices, identifiers are not requested; the right to obtain a file does not include the right to combine it with others or train models on it. Federated architecture reduces data movement but parameter or answer exchange can still leak information
Table 17
Data-protection determinations for typical research situations.
A legal officer and a data-protection officer with the required status are appointed; the consortium keeps a register of processing, agreements and deletion deadlines (Table 17). Data-subject requests, corrections and restrictions follow applicable procedures, including lawful limits on disclosure during investigations. A researcher may not unilaterally widen the purpose of closed data.
Regulation (EU) 2024/1689 applies as amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026. Under the current Article 113, the core Chapter III requirements for Annex III systems apply from 2 December 2027 and for Annex I product systems from 2 August 2028 [92,96]. Classification depends on intended purpose. Table 18 summarises the decision matrix, including the AI-TC.
Table 18
AI Act classification matrix for SHIELD modules.
A technical file records data versions, test results, limitations, human-oversight rules and incident management. The NIST AI RMF may organise risk research but does not establish compliance with EU law [97]. The author’s comparative analyses of national AI strategies and of an ethical AI-law model inform the governance choices [83,98].
The threat model includes unauthorised disclosure, alteration of material, insider abuse, supplier compromise and re-identification. Measures include role-, purpose- and time-limited access with multi-factor authentication; versions, checksums and protected logs; export control and isolation; supply-chain audits; minimisation; and tested recovery.
Table 19
Threat model and controls.
Directive 2019/1937 and national rules set protections for reporting persons [99]; SHIELD initially directs reporters to established competent channels and never assigns reporters a credibility score. The identity of a reporter is stored separately from analytical material.
SHIELD is organised as a contractual network consortium with a coordinator, scientific council and executive secretariat; a separate legal entity is considered only after review of tasks, jurisdiction, liability and funding. The consortium has no public-authority powers. A participant selling an analytical product does not evaluate its own effectiveness; funders do not approve factual conclusions about specific persons; experts with conflicts are recused and the replacement recorded. Methodological standards are published under a clear licence; negative results may not be suppressed because they are inconvenient.
Table 20
Consortium functions and independence controls.
The programme runs for 30 months (Fig. 9). Legal and data-quality work starts before model development; moving to closed data and expanding the user base are separate decisions taken after reviewing the preceding stage. Gate decisions are: by month 3, consortium agreement and task list; by month 6, first pilot protocol, baseline corpus and legal map; by month 14, held-out test results; by month 24, independent reports on usefulness and errors; by month 30, a continuation decision. Peak staffing is up to 12 full-time equivalents (FTE); average planned load is 9.6 FTE or 288 person-months.
Fig. 9. Work packages and gate decisions (G1–G5) over 30 months, including the Web 4.0 sandbox for the AI-TC.
Four pilots are proposed (Table 21). Pilot 1 tests whether SHIELD improves selection of material for manual control in an EU institution at comparable resources; assuming 25% versus 40% confirmed useful results, a two-sided and power 0.80 require about 152 observations per group, and a design effect of 1.95 (cluster size 20, ICC 0.05) raises this to about 297. Pilot 2 tests financial typologies with FIUs using synthetic chains first. Pilot 3 evaluates a second-review intervention for declarations and recusals with staggered roll-out. Pilot 4 evaluates the AI-TC in a regulatory sandbox on a testnet with a synthetic virtual-world economy, combining the AI Act sandbox regime with CASP supervisory cooperation.
The sample-size calculation for Pilot 1 uses the normal approximation for two independent proportions:
The proportions are planning assumptions, not measured SHIELD effects; the number of clusters, attrition and the actual design require separate calculation or simulation. The primary indicator is the share of confirmed outcomes at fixed resources; secondary indicators are analyst time, cost per useful review, missed cases, quality of explanations and material identification errors. The practically significant improvement is fixed by the process owner before testing, since statistical significance alone does not justify deployment. A pilot stops on unlawful access, uncontrolled leakage, damaged provenance or systematic errors causing material harm.
Table 21 Pilots, primary outcomes and limits of claims
The scenario assumes 288 person-months (24 FTE-years) at an illustrative full cost of EUR 90 000 per FTE-year (Table 22). It is not a commercial estimate or a funding commitment.
Table 22
Illustrative 30-month budget scenario (EUR).
A 20% change in full FTE cost changes the total by EUR 496 800 if other assumptions hold. Scaling requires a confirmed advantage on the pre-selected outcome, acceptable costs and a positive opinion of the independent risk group; counts of cases, reports, models and participants describe activity and do not replace outcome indicators.
The framework responds to a recurrent finding in the literature: emerging technologies can support anti-corruption work, but evidence of impact is thin and context-dependent [11,81]. Procurement risk indicators and early-warning models are promising [9,10,50], and field-experimental evidence shows that audits can reduce leakage [100], yet their portability to EU institutions is untested; SHIELD therefore treats each method as a hypothesis with a pre-registered test rather than as a product. The emphasis on base rates, calibration and leakage reflects methodological lessons from ML-based science [53,54] and the case for interpretable models in high-stakes settings [55].
The Web 4.0 component extends this logic to a domain where most proposals focus either on AML compliance of CASPs or on metaverse governance in general [15,16,101,102]. The AI-TC differs in three respects. First, it links corruption intelligence from public-integrity processes with transaction control, addressing the specific pattern of post-award benefit transfer. Second, it is designed as a legal institute—a delegated commissioner with bounded powers, time limits, reasons and remedies—rather than as a purely technical filter. Third, it uses blockchain not as a source of truth but as tamper-evident infrastructure for accountability [63,64]. This corresponds to the author’s thesis that the metaverse requires digital legislation and digital jurisdiction as integral components of Web 4.0 [22,24,82].
Several tensions remain. Real-time blocking at scale risks large absolute numbers of false positives even at low error rates, with chilling effects on lawful activity; this is why thresholds are capacity-bound and holds default to release. Privacy-preserving techniques may conflict with investigators’ need for detail; zero-knowledge proofs and privacy pools offer a middle path but require standardisation [77]. Decentralised platforms without an EU-regulated gateway fall outside direct reach, so the AI-TC must be complemented by international cooperation and by on-ramp/off-ramp controls. Finally, any delegation of coercive-looking measures to an algorithm raises questions of legitimacy that only a statutory mandate, transparency and judicial review can answer [83,103].
Limitations of this study include its conceptual character, the absence of empirical case data, reliance on official descriptions of tools whose internals are not public, and the illustrative nature of the simulation and budget. Future research should (i) execute Pilot 1 with an institutional partner, (ii) build an open synthetic Web 4.0 economy for benchmarking transaction-screening models, (iii) test the transferability of graph models across blockchains, and (iv) evaluate legal designs for cross-border recognition of AI-TC decisions, including with Ukraine.
SHIELD can become a sustainable scientific mechanism for improving anti-corruption control if its mandate remains specific, its methods verifiable and its institutional decisions independent. The first-priority result is an agreed protocol for one pilot, a lawful data corpus and an assessment of added value compared with existing practice. For Web 4.0 and metaverse environments, the article proposes a three-tier mechanism of prevention, deterrence and blocking, centred on a blockchain-anchored AI Transaction Commissioner that screens high-risk cross-border transactions and applies graded, time-limited measures under FIU, supervisory and judicial control. A risk signal remains a ground for further review; a finding of wrongdoing requires established facts and a decision of a competent authority. Further development must rest on test results and on the ability to explain errors, including the absence of an expected effect.
Oleksii Kostenko: Conceptualization, Methodology, Investigation, Formal analysis, Visualization, Writing – original draft, Writing – review & editing, Supervision.
[Author 2]: [e.g., Investigation, Validation, Writing – review & editing].
[Author 3]: [e.g., Data curation, Resources, Writing – review & editing].
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper
This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors.
No empirical case data were used. The parameters of the synthetic simulation are fully reported in Section 5.6; the code used to generate the simulation and figures is available from the corresponding author on reasonable request.
During the preparation of this work the author(s) used Claude (Anthropic) in order to restructure the manuscript, translate and edit the text and prepare figures. After using this tool, the author(s) reviewed and edited the content as needed and take(s) full responsibility for the content of the published article.
[Optional: acknowledgements.]
[1] Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’), OJ L 283, 31.10.2017, pp. 1–71 (Arts 22–25, 37). https://eur-lex.europa.eu/eli/reg/2017/1939/oj/eng
[2] Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol), consolidated text of 11.1.2026. https://eur-lex.europa.eu/eli/reg/2016/794/2026-01-11/eng
[3] European Anti-Fraud Office (OLAF), What we do, European Commission. https://anti-fraud.ec.europa.eu/about-us/what-we-do_en (accessed 11 October 2026).
[4] Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), OJ L, 2024/1620. https://eur-lex.europa.eu/eli/reg/2024/1620/oj/eng
[5] Eurojust, Tasks and tools of Eurojust. https://www.eurojust.europa.eu/judicial-cooperation/tasks-and-tools (accessed 11 October 2026).
[6] Directive (EU) 2026/1021 of the European Parliament and of the Council of 29 April 2026 on combating corruption, OJ L, 11.5.2026 (Arts 20, 21, 37, 39). https://eur-lex.europa.eu/eli/dir/2026/1021/oj/eng
[7] European Court of Auditors, Special report 26/2025: EU bodies fighting fraud – Clear mandates but exchange of information and Commission oversight remain insufficient, Luxembourg, 2025. https://www.eca.europa.eu/ECAPublications/SR-2025-26/SR-2025-26_EN.pdf
[8] European Court of Auditors, Special report 06/2026: Tackling fraud in the RRF – Work in progress, Luxembourg, 2026. https://www.eca.europa.eu/ECAPublications/SR-2026-06/SR-2026-06_EN.pdf
[9] M. Fazekas, I.J. Tóth, L.P. King, An objective corruption risk index using public procurement data, Eur. J. Crim. Policy Res. 22 (2016) 369–397. https://doi.org/10.1007/s10610-016-9308-z
[10] J. Gallego, G. Rivero, J. Martínez, Preventing rather than punishing: An early warning model of malfeasance in public procurement, Int. J. Forecast. 37 (2021) 360–377. https://doi.org/10.1016/j.ijforecast.2020.06.006
[11] I. Adam, M. Fazekas, Are emerging technologies helping win the fight against corruption? A review of the state of evidence, Inf. Econ. Policy 57 (2021) 100950. https://doi.org/10.1016/j.infoecopol.2021.100950
[12] M.S.M. Lima, D. Delen, Predicting and explaining corruption across countries: A machine learning approach, Gov. Inf. Q. 37 (2020) 101407. https://doi.org/10.1016/j.giq.2019.101407
[13] European Commission, An EU initiative on Web 4.0 and virtual worlds: A head start in the next technological transition, COM(2023) 442 final, Strasbourg, 11.7.2023.
[14] European Parliament, Resolution of 17 January 2024 on virtual worlds – opportunities, risks and policy implications for the single market (2022/2198(INI)), Strasbourg, 2024.
[15] Europol, Policing in the Metaverse: What Law Enforcement Needs to Know, Europol Innovation Lab Observatory Report, Publications Office of the EU, Luxembourg, 2022.
[16] INTERPOL, Metaverse: A Law Enforcement Perspective – Use Cases, Crime, Forensics, Investigation, and Governance, INTERPOL Innovation Centre White Paper, Lyon/Singapore, January 2024.
[17] O. Kostenko, D. Zhuravlov, O. Dniprov, O. Korotiuk, Metaverse: Model criminal code, Balt. J. Econ. Stud. 9 (4) (2023) 134–147. https://doi.org/10.30525/2256-0742/2023-9-4-134-147
[18] O.V. Kostenko, O.E. Radutnyi, Blockchain and the metaverse: Legal aspects, Jurid. Sci. Electron. J. 9 (2022) 499–506. https://doi.org/10.32782/2524-0374/2022-9/123
[19] D. Dupuis, K. Gleason, Money laundering with cryptocurrency: Open doors and the regulatory dialectic, J. Financ. Crime 28 (2021) 60–74. https://doi.org/10.1108/JFC-06-2020-0113
[20] Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 on the financial rules applicable to the general budget of the Union (recast), OJ L, 2024/2509 (Arts 36, 61). https://eur-lex.europa.eu/eli/reg/2024/2509/oj/eng
[21] Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement, OJ L 94, 28.3.2014, pp. 65–242. https://eur-lex.europa.eu/eli/dir/2014/24/oj/eng
[22] O. Kostenko, V. Furashev, D. Zhuravlov, O. Dniprov, Genesis of legal regulation Web and the model of the electronic jurisdiction of the metaverse, Bratisl. Law Rev. 6 (2) (2022) 21–36. https://doi.org/10.46282/blr.2022.6.2.316
[23] O. Kostenko, D. Zhuravlov, V. Nikitin, V. Manhora, T. Manhora, A typical cross-border metaverse model as a counteraction to its fragmentation, Bratisl. Law Rev. 8 (2) (2024) 163–176. https://doi.org/10.46282/blr.2024.8.2.844
[24] O. Kostenko, Digital jurisdiction, Metaverse Sci. Soc. Law 1 (2) (2025). https://doi.org/10.69635/mssl.2025.1.2.23
[25] O. Kostenko, Digital jurisdiction: A model, Inf. Law 4 (55) (2025) (in Ukrainian). https://doi.org/10.37750/2616-6798.2025.4(55).346297
[26] O.V. Kostenko, Electronic jurisdiction, metaverse, artificial intelligence, digital personality, digital avatar, neural networks: Theory, practice, perspective, World Sci. 1 (73) (2022) 1–13. https://doi.org/10.31435/rsglobal_ws/30012022/7751
[27] O. Kostenko, O. Dniprov, D. Zhuravlov, Metaverse: Ensuring legal recognition of avatars and electronic personalities through a cross-border personalized ID-code, Int. J. Innov. Technol. Soc. Sci. 2 (42) (2024). https://doi.org/10.31435/rsglobal_ijitss/30062024/8141
[28] O.V. Kostenko, Identification data management: Legal regulation and classification, Public Law (PNAP) 43 (6) (2020) 198–203. https://doi.org/10.23856/4325
[29] United Nations, United Nations Convention against Corruption, adopted 31 October 2003, UN Treaty Collection, Chapter XVIII, No. 14. https://treaties.un.org/pages/viewdetails.aspx?chapter=18&mtdsg_no=xviii-14&src=treaty
[30] INTERPOL, Legal framework and legal documents. https://www.interpol.int/en/Who-we-are/Legal-framework/Legal-documents (accessed 11 October 2026).
[31] Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, OJ L, 2024/1624 (Art. 90). https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng
[32] Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, OJ L, 2024/1640 (Arts 12, 13). https://eur-lex.europa.eu/eli/dir/2024/1640/oj/eng
[33] AMLA, Frequently asked questions. https://www.amla.europa.eu/faqs_en (accessed 11 October 2026).
[34] FATF, International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations, FATF, Paris, updated version (Recs 15, 16, 29, 40). https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html
[35] Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union’s financial interests by means of criminal law, OJ L 198, 28.7.2017, pp. 29–41. https://eur-lex.europa.eu/eli/dir/2017/1371/oj/eng
[36] Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCA), OJ L 150, 9.6.2023, pp. 40–205. https://eur-lex.europa.eu/eli/reg/2023/1114/oj/eng
[37] Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets (TFR), OJ L 150, 9.6.2023, pp. 1–39. https://eur-lex.europa.eu/eli/reg/2023/1113/oj/eng
[38] European Banking Authority, Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (Travel Rule Guidelines), EBA/GL/2024/11, Paris, 4 July 2024.
[39] Council Directive (EU) 2023/2226 of 17 October 2023 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC8), OJ L, 2023/2226, 24.10.2023. https://eur-lex.europa.eu/eli/dir/2023/2226/oj/eng
[40] FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers, FATF, Paris, October 2021.
[41] FATF, Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers, FATF, Paris, July 2024.
[42] FATF, Guidance on Politically Exposed Persons (Recommendations 12 and 22), FATF, Paris, 2013.
[43] European Commission, Anti-Fraud Knowledge Centre, What is ARACHNE. https://antifraud-knowledge-centre.ec.europa.eu/useful-tools/what-arachne_en (accessed 11 October 2026).
[44] European Commission, EDES database. https://commission.europa.eu/strategy-and-policy/eu-budget/how-it-works/annual-lifecycle/implementation/anti-fraud-measures/edes/edes-database_en (accessed 11 October 2026).
[45] OLAF, Union Anti-Fraud Programme – IMS component. https://anti-fraud.ec.europa.eu/policy/union-anti-fraud-programme-uafp/union-anti-fraud-programme-ims-component_en (accessed 11 October 2026).
[46] European Commission, Funding recipients – Financial Transparency System. https://commission.europa.eu/about/service-standards-and-principles/transparency/funding-recipients_en (accessed 11 October 2026).
[47] Publications Office of the European Union, TED Developers’ corner for reusers. https://ted.europa.eu/en/simap/developers-corner-for-reusers (accessed 11 October 2026).
[48] T. Gebru, J. Morgenstern, B. Vecchione, J.W. Vaughan, H. Wallach, H. Daumé III, K. Crawford, Datasheets for datasets, Commun. ACM 64 (12) (2021) 86–92. https://doi.org/10.1145/3458723
[49] Court of Justice of the European Union, Judgment of 22 November 2022 in Joined Cases C-37/20 and C-601/20, WM and Sovim SA v Luxembourg Business Registers, ECLI:EU:C:2022:912; Press Release No 188/22. https://curia.europa.eu/site/upload/docs/application/pdf/2022-11/cp220188en.pdf
[50] M. Fazekas, G. Kocsis, Uncovering high-level corruption: Cross-national objective corruption risk indicators using public procurement data, Br. J. Polit. Sci. 50 (2020) 155–164. https://doi.org/10.1017/S0007123417000461
[51] M. Fazekas, I.J. Tóth, From corruption to state capture: A new analytical framework with empirical applications from Hungary, Polit. Res. Q. 69 (2016) 320–334. https://doi.org/10.1177/1065912916639137
[52] T. Pourhabibi, K.-L. Ong, B.H. Kam, Y.L. Boo, Fraud detection: A systematic literature review of graph-based anomaly detection approaches, Decis. Support Syst. 133 (2020) 113303. https://doi.org/10.1016/j.dss.2020.113303
[53] T. Saito, M. Rehmsmeier, The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets, PLOS ONE 10 (2015) e0118432. https://doi.org/10.1371/journal.pone.0118432
[54] S. Kapoor, A. Narayanan, Leakage and the reproducibility crisis in machine-learning-based science, Patterns 4 (2023) 100804. https://doi.org/10.1016/j.patter.2023.100804
[55] C. Rudin, Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead, Nat. Mach. Intell. 1 (2019) 206–215. https://doi.org/10.1038/s42256-019-0048-x
[56] NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, Gaithersburg, MD, 2024. https://doi.org/10.6028/NIST.AI.600-1
[57] EDPS, Guidance on Generative AI: Strengthening data protection in a rapidly changing digital era, Brussels, 28 October 2025.
[58] M. Mitchell, S. Wu, A. Zaldivar, P. Barnes, L. Vasserman, B. Hutchinson, E. Spitzer, I.D. Raji, T. Gebru, Model cards for model reporting, in: Proc. Conf. Fairness, Accountability, and Transparency (FAT* ’19), ACM, 2019, pp. 220–229. https://doi.org/10.1145/3287560.3287596
[59] European Commission, Staff and ethics. https://commission.europa.eu/about/service-standards-and-principles/ethics-and-good-administration/staff-and-ethics_en (accessed 11 October 2026).
[60] European Union, Transparency Register – Guidelines. https://transparency-register.europa.eu/guidelines_en (accessed 11 October 2026).
[61] OECD, OECD Public Integrity Handbook, OECD Publishing, Paris, 2020. https://doi.org/10.1787/ac8ed8e8-en
[62] OECD, Recommendation of the Council on Public Integrity, OECD/LEGAL/0435, OECD, Paris, 2017.
[63] K. Werbach, The Blockchain and the New Architecture of Trust, MIT Press, Cambridge, MA, 2018. https://doi.org/10.7551/mitpress/11449.001.0001
[64] S. Ølnes, J. Ubacht, M. Janssen, Blockchain in government: Benefits and implications of distributed ledger technology for information sharing, Gov. Inf. Q. 34 (2017) 355–364. https://doi.org/10.1016/j.giq.2017.09.007
[65] EPPO, Reporting a crime to the EPPO. https://www.eppo.europa.eu/reporting-crime-eppo_en (accessed 11 October 2026).
[66] European Union, Charter of Fundamental Rights of the European Union, OJ C 326, 26.10.2012, pp. 391–407 (Arts 7, 8, 41, 47, 48). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT
[67] OLAF, Procedural guarantees. https://anti-fraud.ec.europa.eu/investigations/procedural-guarantees_en (accessed 11 October 2026).
[68] S. Mystakidis, Metaverse, Encyclopedia 2 (2022) 486–497. https://doi.org/10.3390/encyclopedia2010031
[69] S. Nakamoto, Bitcoin: A peer-to-peer electronic cash system, 2008. https://bitcoin.org/bitcoin.pdf
[70] O.V. Kostenko, Artificial intelligence (AI) and the metaverse: Legal aspects, Jurid. Sci. Electron. J. 8 (2022) 301–308. https://doi.org/10.32782/2524-0374/2022-8/66
[71] S. Foley, J.R. Karlsen, T.J. Putniņš, Sex, drugs, and Bitcoin: How much illegal activity is financed through cryptocurrencies? Rev. Financ. Stud. 32 (2019) 1798–1853. https://doi.org/10.1093/rfs/hhz015
[72] Chainalysis, The 2025 Crypto Crime Report, Chainalysis Inc., New York, 2025.
[73] O. Kostenko, D. Zhuravlov, Reconceptualizing jurisdiction and legal identity in the metaverse: Elements of a digital code architecture, Metaverse Sci. Soc. Law 1 (1) (2025).
[74] O.V. Kostenko, D.V. Zhuravlov, O.S. Dniprov, O.V. Korotiuk, New horizons of law: From electronic jurisdiction to the model criminal code of the metaverse, Inf. Law 2 (49) (2024) 43–61 (in Ukrainian).
[75] Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, OJ L, 2024/1183, 30.4.2024. https://eur-lex.europa.eu/eli/reg/2024/1183/oj/eng
[76] Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data (Data Act), OJ L, 2023/2854, 22.12.2023 (Art. 36). https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng
[77] V. Buterin, J. Illum, M. Nadler, F. Schär, A. Soleimani, Blockchain privacy and regulatory compliance: Towards a practical equilibrium, Blockchain Res. Appl. 5 (2024) 100176. https://doi.org/10.1016/j.bcra.2023.100176
[78] Commission Delegated Regulation (EU) 2016/1675 of 14 July 2016 supplementing Directive (EU) 2015/849 by identifying high-risk third countries with strategic deficiencies, OJ L 254, 20.9.2016, pp. 1–4 (as amended). https://eur-lex.europa.eu/eli/reg_del/2016/1675/oj/eng
[79] S. Goldwasser, S. Micali, C. Rackoff, The knowledge complexity of interactive proof systems, SIAM J. Comput. 18 (1989) 186–208. https://doi.org/10.1137/0218012
[80] P. De Filippi, A. Wright, Blockchain and the Law: The Rule of Code, Harvard University Press, Cambridge, MA, 2018.
[81] P. Aarvik, Blockchain as an Anti-Corruption Tool: Case Examples and Introduction to the Technology, U4 Issue 2020:7, Chr. Michelsen Institute, Bergen, 2020.
[82] O. Kostenko, O. Dniprov, D. Zhuravlov, O. Tykhomyrov, S. Vladov, A new paradigm of metaverse philosophy: From anthropocentrism to metasubjectivity, Philosophies 10 (6) (2025) 117. https://doi.org/10.3390/philosophies10060117
[83] O. Kostenko, AI Law Model for Ethical Legislation: Strategic Recommendations for the Regulation of Artificial Intelligence, SciFormat Publishing, Calgary, 2025.
[84] M. Weber, G. Domeniconi, J. Chen, D.K.I. Weidele, C. Bellei, T. Robinson, C.E. Leiserson, Anti-money laundering in Bitcoin: Experimenting with graph convolutional networks for financial forensics, KDD ’19 Workshop on Anomaly Detection in Finance, 2019. https://arxiv.org/abs/1908.02591
[85] S. Wachter, B. Mittelstadt, C. Russell, Counterfactual explanations without opening the black box: Automated decisions and the GDPR, Harv. J. Law Technol. 31 (2018) 841–887.
[86] S.M. Lundberg, S.-I. Lee, A unified approach to interpreting model predictions, in: Adv. Neural Inf. Process. Syst. 30 (NeurIPS 2017), 2017, pp. 4765–4774.
[87] L. Lessig, Code and Other Laws of Cyberspace, Basic Books, New York, 1999.
[88] Egmont Group, Principles for Information Exchange Between Financial Intelligence Units, 2013, revised 15 April 2023 (Principles 26, 32).
[89] Law of Ukraine No. 2074-IX of 17 February 2022 ‘On Virtual Assets’, Verkhovna Rada of Ukraine, Kyiv, 2022.
[90] BIS Innovation Hub, Project Aurora: The Power of Data, Technology and Collaboration to Combat Money Laundering across Institutions and Borders, Bank for International Settlements, Basel, May 2023.
[91] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), OJ L 119, 4.5.2016, pp. 1–88 (Arts 5, 6, 9, 10, 22, 35, 89). https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
[92] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), consolidated text of 27.7.2026 (Art. 5, Annex III, Art. 113). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727
[93] ISO/IEC 42001:2023, Information technology – Artificial intelligence – Management system, International Organization for Standardization, Geneva, 2023.
[94] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for law-enforcement purposes, OJ L 119, 4.5.2016, pp. 89–131. https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng
[95] Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies, OJ L 295, 21.11.2018, pp. 39–98. https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng
[96] Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulation (EU) 2024/1689, OJ L, 24.7.2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
[97] NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, Gaithersburg, MD, 2023. https://doi.org/10.6028/NIST.AI.100-1
[98] O.V. Kostenko, Analysis of national strategies for the development of artificial intelligence, Inf. Law 2 (41) (2022) 58–69. https://doi.org/10.37750/2616-6798.2022.2(41).270365
[99] Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, OJ L 305, 26.11.2019, pp. 17–56. https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng
[100] B.A. Olken, Monitoring corruption: Evidence from a field experiment in Indonesia, J. Polit. Econ. 115 (2007) 200–249. https://doi.org/10.1086/517935
[101] Y.K. Dwivedi, L. Hughes, A.M. Baabdullah, et al., Metaverse beyond the hype: Multidisciplinary perspectives on emerging challenges, opportunities, and agenda for research, practice and policy, Int. J. Inf. Manag. 66 (2022) 102542. https://doi.org/10.1016/j.ijinfomgt.2022.102542
[102] Y. Wang, Z. Su, N. Zhang, R. Xing, D. Liu, T.H. Luan, X. Shen, A survey on metaverse: Fundamentals, security, and privacy, IEEE Commun. Surv. Tutor. 25 (2023) 319–352. https://doi.org/10.1109/COMST.2022.3202047
[103] M. Veale, F. Zuiderveen Borgesius, Demystifying the Draft EU Artificial Intelligence Act, Comput. Law Rev. Int. 22 (2021) 97–112. https://doi.org/10.9785/cri-2021-220402
Copyright 2022-2026 "IDIKSA" All Rights Reserved by IDIKSA LLP
This article addresses a critically important and highly relevant topic: the adaptation of European Union anti-corruption mechanisms to the realities of Web 4.0. The implementation of the SHIELD concept and the autonomization of oversight via an AI-driven blockchain transaction commissioner represent a bold step toward the “Law as Code” paradigm.
The authors propose an innovative institutional solution to the “principal-agent” problem within EU structures. Shifting monitoring-related transaction costs to the blockchain and automating compliance through AI could potentially save billions of euros from the EU budget currently allocated to auditing and anti-corruption efforts.
This article addresses a critically important and highly relevant topic: the adaptation of European Union anti-corruption mechanisms to the realities of Web 4.0. The implementation of the SHIELD concept and the autonomization of oversight via an AI-driven blockchain transaction commissioner represent a bold step toward the “Law as Code” paradigm.