FTM Ontology

FollowTheMoney

OSINT AI One uses the FollowTheMoney (FTM) ontology to structure entities extracted from investigations. It’s the same standard used by OCCRP, OpenSanctions, and other investigative journalism organizations.

The 12 entity types

Type	Description	Examples
`Person`	Natural person	John Smith, Dr. Ana Martinez
`Company`	Commercial enterprise	Acme Corp LLC, Tech Holdings Inc
`Organization`	Non-profit, NGO	Red Cross, Anonymous
`PublicBody`	Government agency	Department of Interior, FBI
`Domain`	Domain name	acme-corp.com, evil.ru
`Email`	Email address	attacker@protonmail.com
`Phone`	Phone number	+1 555 123 4567
`UserAccount`	Social media or platform account	@attacker on Twitter
`BankAccount`	Bank account	IBAN GB82 WEST…
`Document`	Document with identity	Contract PDF, corporate report
`Event`	Event with date and location	Meeting 2024-03-15 in London
`Location`	Geographic location	London, Oxford Street 1

Normalization for international entities

The system applies normalization rules appropriate for the context:

People

# Removal of titles when normalizing
"Mr. John Smith" → "John Smith"
"Dr. Ana Martinez PhD" → "Ana Martinez"
"Ms. Maria Lopez" → "Maria Lopez"

# Consistent name/surname order
"Smith, John" → "John Smith"

Companies

# Business form normalization
"ACME CORPORATION INCORPORATED" → "ACME CORPORATION Inc"
"Tech Holdings, LLC" → "Tech Holdings LLC"
"Investments 2020 Ltd." → "Investments 2020 Ltd"

# Business identifiers
Registration ID normalization for different jurisdictions

Identity documents

# Various document types normalized to uppercase
"12345678-X" → "12345678X"
"12.345.678 X" → "12345678X"

# Passport normalization
"US-123456789" → "US123456789"

# International bank accounts
"GB82 WEST 1234 5698 7654 32" → "GB82WEST12345698765432"

Phone numbers

# Normalization with international prefix
"(555) 123-4567" → "+1 555 123 4567"
"1-800-CALL-NOW" → "+1 800 225 5669"
"555-123-4567" → "+1 555 123 4567"  # assumes US if no prefix

How it’s used in practice

Automatic extraction

/entity-extract

The system uses the LLM to identify entities in evidence text and automatically normalizes them before saving to SQLite.

Deduplication

Before inserting an entity, the system checks if a similar entity already exists:

Same type + same normalized identifier → updates, doesn’t duplicate
Configurable similarity threshold for names (Levenshtein)

Manual management

/db-manage merge-entities --id1 ent_001 --id2 ent_002
/db-manage update-entity --id ent_001 --field name --value "John Smith"
/db-manage delete-entity --id ent_003

Entity relationships

Beyond entity types, you can register relationships:

Relationship	Example
`owns`	Person X owns Company Y
`controls`	Company A controls Company B
`member_of`	Person X is member of Organization Y
`located_at`	Company X located in Location Y
`registered_in`	Company X registered in Domain Y
`uses`	Actor X uses UserAccount Y
`associated_with`	IP X associated with Domain Y

Schema in SQLite

The osint_ai.db database has 8 main tables:

investigations   -- Investigation metadata
evidences        -- Ingested documents with SHA-256
entities         -- Extracted entities (type + value + metadata)
relationships    -- Entity relationships
claims           -- Assertions with traceability
alerts           -- Scheduled alerts
entity_mentions  -- Entity mentions in evidence
sessions         -- Work sessions

See Reference → FTM Entity Types for the complete schema.