A Reproducible Normalization Model for Forensic Analysis of Heterogeneous Bank Statements: Design and Internal-Consistency Evaluation on a Synthetic Corpus

Bank statements are information-rich but labour-intensive forensic sources: differing formats, inconsistent field naming, incomplete counterparty attributes and mixed debit–credit conventions make cross-account comparison unsafe, and an automated summary is easily read later as established fact. We propose a reproducible normalization model converting heterogeneous statement records into one auditable transaction journal, each row bound to its source line. It separates the source document, the normalized record and the interpretive indicator, formalizes an eight-stage cycle from inventory and hash control to quality control and indicator generation, and attaches an evidential status to every reconstructed route. The evaluation is entirely synthetic: the corpus, whose defects have known type and position, was generated by the same authors who built the control layer, so the scores below are an internal-consistency check rather than evidence of performance on real bank exports. The corpus, its generator and a reference implementation of the model are released with the article. Across 1200 transactions from 30 files and 15 layouts, all 8 mandatory fields map completely while counterparty identifiers reach 0.573. The control layer flags 55 of the 57 injected defects with no false candidate; the two misses are undetectable by construction and are reported as such. Reclassifying one channel-only record changes precision from 1.000 to 0.982 and F1 from 0.982 to 0.973. On eight fault types the generator never produces, seven are surfaced in the defect log and one, a day–month swap, passes largely unnoticed. On data with no planted behavior, the indicators flag from none to 11 of 12 subjects depending on the threshold, so thresholds need calibration against a reference population. Removing the lineage tuple or the defect log leaves detection unchanged while removing source references or suppressing some logged warnings, showing that detection scores alone do not describe the output’s auditability. Validation on real exports and review by independent assessors remain open.