The Sycamore Network.
How a $50M family foundation discovers a 12-grantee shell network with $4.3M in misappropriated grants over 18 months - and recovers $3.1M (72%) in an 11-month workflow on Attestyx.
The setup
Sycamore Charitable Trustis a US-based, $50M-AUM family foundation operating since 2009. Programs: education access, food security, mental health. ~140 grants per year, average $350K. Tier 2 Comprehensive engagement with GrantsProof since January 2026.
Sycamore's board is family-led with two outside directors. Grant decisions are made by a 3-person committee with program-officer recommendations. Average grant approval cycle: 4 weeks.
The pattern
Over 18 months, Sycamore approves grants to 12 grantees in their education-access portfolio. Each grant is small ($150K-$450K). Each grantee has a clean Form 990, board roster, and tax-exempt determination. Each grantee passes individual sanctions screening at intake.
The 12 grantees collectively cycle$4.3Mthrough their accounts via subgrants and program expenses that, on paper, fund educational programs. In reality:
- 9 of the 12 grantees share the same Director of Operations - a name that appears in the personnel disclosure of each.
- 7 of the 12 grantees share a beneficial owner (25%+) at the Director's spouse - who, after 14 months on the network, is added to OFAC's SDN list following sanctions on her UAE-based parent organization.
- 11 of the 12 grantees use the same payment processor and route 60-80% of their grant funds to a small set of vendors that, on closer inspection, are LLCs operating from the same Wyoming registered-agent address.
- 4 of the 12 grantees have nearly-identical program narratives - same theory of change, same target population text, varying numerical targets but identical sentence structure.
What the Verdict Engine catches
The 148-check Verdict Engine surfaces this pattern over multiple signals across 6 categories. Here's what Sycamore's reviewer console shows on the 13th application from the network:
| Check | Category | Score | Detail |
|---|---|---|---|
| SAN-004 | Sanctions (BO) | 100 (HARD BLOCK) | Beneficial owner matches OFAC SDN list as of 2026-08-12 (UAE-based parent designated) |
| NET-001 | Network Effects | 80 | BO appears across 7 prior grantees (90-day window); shared Director appears across 9 |
| NET-006 | Network Effects | 90 (HARD BLOCK) | EIN collision: registered to same physical address as 3 other grantees with overlapping personnel |
| BEN-006 | Beneficial Ownership | 80 | Beneficial owner in high-risk jurisdiction (UAE flagged after sanctions update) |
| ANO-006 | Anomaly Detection | 90 | Narrative n-gram hash matches 4 prior applications in 180-day window (duplicate narrative) |
| ANO-007 | Anomaly Detection | 35 | Z-score 2.1 vs historical approved-grant amounts in this program |
| FIN-007 | Financial | 40 | Single revenue source >50% (Sycamore itself) - concentration risk |
| NET-005 | Network Effects | 30 | Decline rate spike on prior network applications at peer foundations (cross-foundation registry) |
Verdict Engine aggregate score:67/100, decision NO. Hard blocks SAN-004 and NET-006 alone would block the application; the cluster of NET signals reveals the network. Sycamore's reviewer console highlights the 12 prior grantees in the same cluster with one click.
The retrospective
Sycamore's team uses the Recovery Evidence engagement to investigate the 12 prior grants. JIL builds CREB attestation packages for each, including:
- Full beneficial-ownership graph: nodes = entities/individuals; edges = ownership/control relationships; network depth = 4 (foundations → grantee LLCs → vendors → ultimate beneficial owners).
- Personnel cross-reference matrix: who appears in which grantee's personnel list, by role and FTE.
- Sanctions retrospective screening: when did each beneficial owner first appear on a list? What did Sycamore know and when?
- Program narrative similarity hashes for all 12 grants.
- Vendor-payment trace: which vendors received subgrant funds, what addresses they registered at, what their corporate filings show.
- Authorized-signer fingerprint: the same set of 3 individuals signed for 11 of the 12 grants.
FRE 902(14) admissibility
Each CREB attestation is anchored to CourtChain (14-of-20 BFT validator quorum across 13 jurisdictions, Ed25519 + Dilithium-III hybrid signatures). The CourtChain anchor + the receipt's self-authenticating cryptographic certification together satisfy Federal Rule of Evidence 902(14)for self-authenticating certified electronic records, eliminating the need for foundation counsel to authenticate evidence at trial via witness testimony.
The package Sycamore receives islitigation-ready. Their counsel files clawback complaints in 7 jurisdictions with attached CREB packages; 5 of 7 cases settle within 90 days based on the strength of evidence; 2 proceed to summary judgment, both granted in Sycamore's favor in part because the evidence chain is unimpeachable.
Recovery
| Grant | Amount | Outcome | Recovered |
|---|---|---|---|
| Grants 1-4 (network principals) | $1.6M | Settlement (90 days) | $1.6M (100%) |
| Grants 5-7 (intermediaries) | $1.2M | Settlement (60 days) | $0.85M (71%) |
| Grants 8-10 (downstream) | $1.05M | Default judgment | $0.65M (62% - assets dissipated) |
| Grants 11-12 (peripheral) | $0.45M | Charged off | $0 (entities dissolved before service) |
| Total | $4.3M | 72% | $3.1M |
The economics
- Recovery Evidence engagement fee: 30% of $3.1M = $930K to Attestyx.
- Sycamore's legal costs: ~$420K total across 7 jurisdictions (recovery-cost cap of 25% under Doc 01 §7.3 was not approached).
- Sycamore net recovery: $3.1M - $930K - $420K = $1.75Mreturned to grant capital.
- Avoided future loss: 13th + 14th + 15th applications from the network were blocked at pre-clearance. Estimated value of avoided loss: $1.5M-$2.0M.
- Cross-foundation benefit: 11 of the 12 grantees were added to the Bad-Actor Registry. 4 peer foundations on the platform received automatic alerts on pending applications from the same network.
- Net economic value to Sycamore: $1.75M direct + $1.5M-$2.0M avoided + $930K paid to GrantsProof that funds the cross-foundation registry that prevents the next attack.Total benefit: ~$3.25M-$3.75M for one engagement.
What Sycamore does differently going forward
After the Sycamore Network engagement, Sycamore moves to a Comprehensive engagement (5%/3%/2% on $50M = $2.5M annual fee). Their reasoning: at the Recovery Evidence economics, they recovered more than the comprehensive fee in a single engagement. Going forward, they want pre-clearance running on every grant + ongoing milestone monitoring + automatic cross-foundation alerts. The 5% fee buys them the structure that prevents the next Sycamore Network from happening in the first place.
How this would land at your foundation
If your foundation has 24+ months of historical disbursements you suspect were misused - or simply want to know what GrantsProof would have caught - the Recovery Evidence engagement runs against your historical data with $0 base fee and 30% of recovered. If GrantsProof finds nothing, you owe nothing. If we find something, you keep 70% of what was recovered. The CREB packages are yours to use in litigation indefinitely.