Investigating comp abuse: spotting structuring and unauthorized value

Most comp abuse is not one dramatic act. It is a pattern, assembled quietly, out of decisions that each look ordinary on their own.

The hard part of investigating comp abuse has never been the paperwork after the fact. It is that the abuse is designed to look like normal work while it happens, and only resolves into a pattern once the value is gone. This guide is about investigating that pattern when the underlying records are already governed and immutable — and about catching the pattern as it forms, rather than reconstructing it months later.

The shapes abuse takes

Comp abuse tends to arrive in a few recognisable shapes, and none of them announce themselves.

• Structuring. Requests deliberately split to stay just under an authority threshold, so no single approval ever escalates. Each comp sits within someone's limit; the intent shows only in the cluster.
• Favours outside the process. Value moved through side channels — a verbal nod, an off-system arrangement — precisely to avoid any governed approval that would leave a record.
• Value steered to connected parties. Comps directed to related parties or house accounts, where the person approving and the person benefiting are closer than the record admits.

What these have in common is that they exploit the gap between written policy and what the floor can actually see in the moment. Close that gap and the shapes lose their cover.

Why after-the-fact detection is too late

The traditional answer to abuse is analysis: pull the month's comps, look for anomalies, escalate what stands out. The trouble is arithmetic. By the time a retrospective report surfaces a structuring cluster, every comp in it has already been issued and spent. Detection that runs on a monthly cadence can only ever tell you what the property has already lost.

Investigation, done this way, becomes an exercise in excavation — reconstructing intent from records that were never designed to preserve it, long after the value left the building. The record is cold, the context is gone, and the best you can offer is a tighter policy for next time.

Catching it in real time

The alternative is to move detection to the moment of decision. In AEGIS, every comp is checked against a delegation-of-authority matrix in real time — an authority decision in under about five milliseconds — and the moment that decision is made, it is broadcast on an event backbone. Nothing waits for a batch job.

Because every decision is published as it happens, a real-time pattern and monitor layer can watch the stream and flag a structuring cluster — many sub-threshold approvals converging on one patron, or flowing from one approver — as it forms. The signal arrives while the next request in the cluster is still in front of someone, not in a report three weeks later.

Investigations that start from evidence, not excavation

When abuse does need investigating, the state of the record decides how hard the work is. In AEGIS, every decision is sealed to an immutable audit trail — hash-chained in the operational database and anchored into an independent ledger the platform itself cannot alter — and each sealed decision carries its ledger anchor and the exact matrix version in force when it was made.

Because the records are already there, already linked, and already immutable, an investigation does not begin by rebuilding what happened. It begins with the evidence in hand. A case surfaces the sealed decisions, the authority that governed them, and the approvers behind them, each carrying cryptographic proof that nothing was altered after the fact. Audit and investigators show up to ask why, not to excavate what.

Relationships matter

Some abuse hides not in the timing but in the recipient. AEGIS tracks related-party and house-account relationships, so a comp steered toward a connected patron or a house account can be flagged at the point of decision — the same moment the authority check runs and exclusion and responsible-gaming checks clear. The connection that a reconciliation might have caught next quarter is surfaced while the comp is still a request, when it still means something.

Side by side

The goal is not to catch more people. It is to make the abusive shapes unworkable — a structuring cluster that lights up as it forms, a favour that has nowhere off-system to go, a steered comp that names its own connection. When the records govern themselves, investigation stops being archaeology and starts being oversight. For the record-keeping foundation that makes this possible, see building a defensible audit trail for comp approvals; for the closely related problem of insiders comping themselves or their circle, see preventing self-dealing in employee comps.

Frequently asked questions

What is comp structuring?

Structuring is splitting value into several requests that each stay just under an authority threshold, so no single approval ever escalates. Individually every comp looks routine; the pattern only shows in aggregate. AEGIS broadcasts each decision the moment it happens, so a real-time monitor can flag a cluster of sub-threshold approvals to one patron or one approver as it forms.

Why is after-the-fact detection too late?

Retrospective analysis surfaces a pattern only after the value has already left the property. By the time a monthly report reconstructs what happened, the comps are spent. Catching abuse in real time means flagging the cluster while it is still forming, when the next approval can still be stopped.

How does AEGIS help investigators?

Because every decision is already sealed, linked, and immutable, an investigation starts from evidence rather than reconstruction. A case surfaces the sealed decisions, the authority matrix version in force at the time, and the approvers — each carrying its ledger anchor as cryptographic proof nothing was altered. Audit shows up to ask why, not to excavate what.

Can AEGIS flag comps steered to related parties?

Yes. AEGIS tracks related-party and house-account relationships, so comps steered to a connected patron or account can be flagged as the decision is made, not discovered later in a reconciliation.