Licensed corporate records support one additional relationship.
Alleged relationships corroborated by a filing a reader can open, drawn from 7 records in corporate registries and a DoJ indictment
Alleged relationships with no filing a reader can open behind them: a single Tier-3 citation, or corroboration held only under subscription. Drawn in amber. Primary-source evidence only fades them and the 8 firms no filed connector reaches, leaving 3 connectors standing
Distinct relationship kinds across the 11 connectors — ownership, rename, financing, trade flow, lease, and director clustering among them
Evidence records behind the figure, each with its own source, authority tier and vintage; every connector names the strongest tier it holds
The alleged OEM → intermediary → end-customer chain: one connector per claimed relationship, over 14 organizations.
Each column head names the tier of the link arriving in it, and an open tick marks a firm with no upstream link in this set.
Layout is by chain position, with 2 connectors reaching past the next position.
Worked example The chain alleged in the Culper Research 2026-05-13 report.
Data-vintage gap · BIS license actionsBIS license-action records end at CY2022 and CY2023+ has not been released, so the window the Culper worked example runs over has no licensing record to check against. Coverage, release cadence and the statutory report, on the trade page.
Each edge carries one of these states, and 4 of 11 edges are corroborated by a record independent of the report. The evidence chain records the sources found and none of the searches that came back empty, so for the 7 edges resting on the report a primary source that was sought and does not exist reads the same as one that has not yet been sought.
Assuming all $4.74B of server/product invoice value purchases GPUs, the selected spending shares and assumed card prices give the counts below. Peak throughput uses BF16 dense arithmetic; effective throughput applies 40% model FLOPs utilization.
Starting assumptionsThe $4,742M starting value exceeds the named flows’ $4,486M subtotal by $256M; the difference remains unreconciled. Culper’s trade reporting is Tier 3; the spending mix, prices and utilization are Scrutica assumptions (Tier 4). NVIDIA specifications support H100, H200 and HGX B300 throughput; H800 uses secondary reporting.
GPU counts and throughput at selected inputs
Caveats
The same 11 relationships as an interactive graph. The “Primary-source only” switch leaves standing the links a reader can check document by document.
Each of the 11 edges falls in one status × tier cell and one relationship-kind row.
Status × cascade tier
| Corroboration status | OEM | Intermediary | End-customer | Total |
|---|---|---|---|---|
| Primary-source corroborated | 1 | 2 | · | 3 |
| Subscription-source corroborated | 1 | · | · | 1 |
| Tradesparq via Culper | · | 4 | · | 4 |
| WSJ via Culper | · | · | 2 | 2 |
| Culper narrative only | · | · | 1 | 1 |
| Total per tier | 2 | 6 | 3 | 11 |
Relationship-kind breakdown · ordered by primary-source share
1 primary-source corroborated
1 primary-source corroborated
1 primary-source corroborated
3 Tradesparq via Culper
2 WSJ via Culper
1 subscription-source corroborated
1 Culper narrative only
1 Tradesparq via Culper
The financing via pledged charge, corporate rename and shared-director clustering edges rest on 7 filings a reader can open. The wholly-owned subsidiary edge is confirmed only against subscription corporate-data sources that cannot be cited for it. The remaining 7 rest on a single Tier-3 citation.
The records behind that count · Tier 1
The corridor named in the March 2026 DoJ indictment, severed at the Supermicro OEM node.
Weighted impact by supply-chain tier
Top affected nodes by tier · per-node impact = severity × decay^depth
L0 Materials/Foundry
L3 Systems/OEM
L4 Cloud/End-User
+4 more on record
Tier-3-aware probes · cannot be modeled on the canonical graph alone
The Aivres → Speedmatrix → Megaspeed → Novagate → Aolani chain runs over 14 edges that exist only in Culper Research’s analyst synthesis, which is what puts Alibaba, ByteDance, IFLYTEK, PT Indosat and Opera within reach of it. The scenarios above run on the canonical graph and see none of them.
Aivres channel cut off, with the relationships Culper alleges downstream of it
BIS enforcement extends across the full Culper-alleged Aivres + Speedmatrix + Megaspeed + Novagate + Aolani chain, reaching Alibaba, IFLYTEK, PT Indosat and Opera four hops out over edges that exist only in Culper’s synthesis.
Aivres alone cut off, the cleanest test of the Culper thesis
BIS extends to Aivres and no further. Two hops, via Speedmatrix and Aolani; ByteDance and Alibaba appear at that second hop only because Tier-3 edges connect them.
Weighted impact = per-node severity × decay^depth, normalized by graph-level node weighting. The 14 Culper-alleged edges are the one Tier-3 input, and they enter the model only while Include Tier-3 Culper edges is switched on.
4 enforcement actions run against Scrutica’s licensed supply-chain graph: BIS designating Aivres alongside Inspur Group; the corridor behind the March 2026 DoJ indictment severed; a Beijing- or Washington-side action cutting Nvidia’s flow to Southeast Asian server makers; and a full US-China decoupling as a comparator. Each reports a severity, a decay rate, a direction, and the countries and firms hit hardest. A companion graph adds the 14 further relationships Culper alleges. The graph is built from a supply-chain database held under subscription and not redistributed.
Each card sets a company’s own filings (SEC, A-share, Hong Kong, Singapore Bizfile, Malaysian SSM) against the analyst account of the same company, and both can be true at once. 2 of the 8 tensions on record appear here. Where a tension rests entirely on subscription sources the card reports the corroboration and withholds the record.
Nvidia changed its geographic-revenue methodology from billing location to customer headquarters location in Q3 FY2026, which removed Singapore from the disclosed geographic split. Singapore-billed revenue had been rising through the preceding disclosure window; what it reached is established here only against subscription sources, and is not republished.
Nvidia stated change reflects 'better representation of the geographic profile of our revenue' — companies' HQ location now overrides Singapore-based billing
Nvidia Q3 FY2026 10-Q (October 2025) — methodology change disclosure· 2025-10
Corroborated against subscription corporate-data sources that cannot be republished (1 record, values withheld); how those records are held and audited.
Per Culper, the methodology change makes pre-2025 and post-2025 geographic-revenue compositions non-comparable, and absent the shift Singapore would still surface as a material exposure even after any operational change.
Supermicro's Mainland China revenue rose across the window straddling the April 2025 export-control tightening, against the direction the restrictions were meant to produce; the level and the rate are established here only against subscription sources, and are not republished. The March 2026 DoJ indictment alleges that a front company — since identified by Bloomberg as OBON Corp — bought approximately $2.5B of servers from an unnamed US manufacturer, of which at least approximately $510M was diverted to China.
USD 2.5B of servers bought via 'Company-1' (Bloomberg-identified as OBON Corp), part of which the indictment alleges was diverted to China
DoJ SDNY indictment of Wally Liaw (March 2026)· 2026-03
Corroborated against subscription corporate-data sources that cannot be republished (1 record, values withheld); how those records are held and audited.
Per Culper, revenue growth during a tightening window is itself a signal worth scrutinizing; the DoJ indictment quantifies one corridor at $2.5B but Culper's narrative interpretation is that this 'is the tip of the iceberg' with multiple parallel OEM/intermediary channels.
PeeringDB is a public directory in which networks declare the facilities they keep equipment in. A shared facility puts two networks in the same building, and a presence record carries nothing about interconnection, BGP sessions, traffic or tenancy.
True IDC (Charoen Pokphand Group / True Corporation subsidiary)·IX: SYMPHONY THAI - IX BANGKOK - 1
Culper relevanceTrue IDC signed MOU with Siam AI per Culper p.38 (Dec 2024) — 'establish Thailand as the Regional AI data center hub'. Direct Culper-named entity.
AS136907Selected Chinese hyperscaler and PRC state-telecom networks declared present at PeeringDB-listed facilities across the Malaysian, Thai, Indonesian, and Singaporean data-center cluster. These facilities are not named in the Culper report; they sit in the same diversion-corridor metropolitan areas.
| Facility | Operator | Declared Chinese networks |
|---|---|---|
| STT Bangkok 1 | ST Telemedia (Singapore-Thai joint venture) | Alibaba (Aliyun) AS45102Huawei Cloud Global AS136907 |
| NTT Cyberjaya Data Center (CBJ) | NTT Global | Alibaba (Aliyun) AS45102 |
| DCI Indonesia (JK5) | DCI Indonesia (Salim Group) | Huawei Cloud Global AS136907ByteDance / TikTok AS396986 |
| China Mobile International - Singapore DC | — | China Mobile International AS58453China Mobile International - NII AS58807 |
YTL Green Data Center / YTL AI Cloud / YTL Communications · Equinix JH1 - Johor · Singapore Equinix SG1-SG5 cluster.
A check without a presence record either matched a listed facility whose participants name no selected Chinese network, or found no listed facility to match. Neither outcome rules a presence in or out. 105 Southeast Asian facilities scanned; 13 with a selected Chinese hyperscaler or PRC state-telecom network declared present. Source: PeeringDB, analyzed 2026-05-14.
7 milestones with a source apiece, from the March 2023 addition of Inspur Group to the BIS Entity List to the 1 June 2026 Warren letter to Nvidia’s General Counsel and Audit Committee Chair. 2 further milestones rest only on press or trade-data reporting (a New York Times shipment story, a Tradesparq trade-volume aggregate) and are kept off it.
The Bureau of Industry and Security designates Inspur Group Co., Ltd. on the Entity List “for acquiring and attempting to acquire U.S.-origin items in support of China’s military modernization efforts.”
A California Secretary of State business filing records the name change from Inspur Systems Inc. to Aivres Systems Inc., about two months after the BIS designation of Inspur Group.
BIS adds six Inspur Group subsidiaries: Inspur (Beijing) Electronic Information Industry Co., Ltd.; Inspur Electronic Information Industry Co., Ltd.; Inspur Electronic Information (Hong Kong) Co., Ltd.; Inspur (HK) Electronics Co., Ltd.; and Inspur Software Co., Ltd. under China, plus Inspur Taiwan, all for all items subject to the EAR, under a policy of denial, with a Footnote 4 designation. The second of those is the Shenzhen-listed issuer that owns the US OEM Aivres Systems Inc., recorded in the Federal Register under the aliases “Inspur Information” and “IEIT Systems Co. Ltd.” BIS designated that intermediate itself, two years after the parent.
Source: Federal Register · BIS Final Rule 2025-05427 (90 FR 14046) ↗
Nvidia’s Q3 FY2026 10-Q discloses a shift in geographic-revenue methodology, from billing-location-of-customer to customer-headquarters-location, because “the end customer and shipping location may be different from customer’s billing location.” Singapore drops out of the disclosed geographic split and the United States share rises to ~70%.
The U.S. Department of Justice unseals an indictment of Yih-Shyan (“Wally”) Liaw, Ruei-Tsang (“Steven”) Chang, and Ting-Wei (“Willy”) Sun for allegedly conspiring to divert high-performance AI servers, assembled in the United States, to China in violation of U.S. export-control law. Per the DoJ release: a front company purchased approximately $2.5B of servers from the U.S. manufacturer (unnamed in the release) across 2024–2025, and at least approximately $510M worth was diverted to China between late April and mid-May 2025 alone, using false documents, staged dummy servers, and transshipment. Senator Warren’s June 1, 2026 letter to Nvidia characterizes the case as involving a Supermicro co-founder and “$510 million in diverted servers.”
Culper Research publishes its NVDA short thesis, synthesizing the Inspur / Aivres / Speedmatrix corporate structure, the Tradesparq trade-volume aggregations, the Nvidia disclosure-methodology shift, and the BIS designation chain.
Source: Culper Research short thesis ↗
Senator Elizabeth Warren (Ranking Member, Senate Banking Committee) writes to Nvidia General Counsel Tim Teter and Audit Committee Chair Brooke Seawell for information about Nvidia’s compliance with U.S. export control laws and the accuracy of its public statements about chip diversion. The letter cites three DOJ enforcement actions: the Nov 20, 2025 arrests for exporting AI technology to China via Malaysia and Thailand (“millions of dollars in GPUs”); the Dec 8, 2025 shutdown of a China-linked AI tech smuggling network (“$160 million in H100 and H200 chips”); and the Mar 19, 2026 indictment (“$510 million in diverted servers”). It quotes CEO Jensen Huang’s public statements that “[t]here’s no evidence of any AI chip diversion” and that Nvidia chip market share in China has “dropped to zero,” and puts four numbered questions to the Audit Committee, response deadline June 18, 2026.
Source: Letter, Sen. Warren to Nvidia · banking.senate.gov ↗
The 2 proposals below concern ownership-based export restrictions and agency access to beneficial-ownership registries; 2 related proposals remain in the full record.
BIS designated Inspur Group in March 2023 and Inspur Information separately in March 2025. A later rule extended restrictions to certain foreign affiliates with at least 50% listed ownership; that rule is stayed from 10 November 2025 through 9 November 2026.
Evidence · 5 premises
Inspur Group Co., Ltd. (a.k.a. Inspur Group; IGL) was added to the Entity List effective 2 March 2023, presumption of denial, Footnote 4.
Federal Register, "Additions and Revisions of Entities to the Entity List", 88 FR 13673 (2023-03-06), document 2023-04558 ↗ · retrieved 2026-08-14
BIS added Inspur Electronic Information Industry Co., Ltd., with the aliases Inspur Information and IEIT Systems Co. Ltd., to the Entity List effective 25 March 2025: all items subject to the EAR, a policy of denial, and Footnote 4.
Federal Register, "Additions to the Entity List", 90 FR 14046 (2025-03-28), document 2025-05427 ↗ · retrieved 2026-08-14
The California register entry for AIVRES SYSTEMS INC. identifies entity 3815827 as a California general stock corporation, initially filed on 11 August 2015 and active when checked on 14 August 2026.
California Secretary of State business search (bizfileonline.sos.ca.gov) ↗ · retrieved 2026-08-14
Inspur Electronic Information Industry Co., Ltd. owns Aivres Systems Inc.
Licensed corporate-ownership data · retrieved 2026-05-14
Ownership corroborated under subscription; see the linked methodology.
The notices give separate designation dates for Inspur Group and Inspur Information, more than two years apart. Neither notice names Aivres Systems Inc.
Scrutica reading of the two Federal Register notices
Reform direction
ProposalConsider extending ownership-based restrictions to controlling parents and controlled entities across intermediate holding companies. The proposal would require defined ownership thresholds and jurisdictional scope, including treatment of US-incorporated subsidiaries.
Beneficial-ownership registers could help export-control agencies identify the people and companies behind a customer. Agency access rights and available interfaces must be established for each jurisdiction.
Evidence · 2 premises
The cited frameworks are Singapore’s register of controllers, Malaysia’s beneficial-ownership provisions and Indonesia’s 2018 beneficial-ownership regulation.
Singapore Companies Act §386AF; Malaysian Companies Act §§60A–60D; Indonesian Presidential Regulation 13/2018
The statutory texts have not been fully reviewed. Malaysia’s SSM guidance distinguishes beneficial-owner criteria (§60A), the register (§60B), company information collection (§60C) and individual notification (§60D). The Indonesian source reviewed identifies the regulation; its provisions remain unchecked.
Access arrangements for foreign export-control authorities remain unverified across these registries.
Agency access arrangements: documentation needed
A comparison requires agency-specific access terms and interface documentation.
Reform direction
ProposalNegotiate secure registry access for partner export-control agencies, with agreed uses and access controls. Assess existing arrangements in each jurisdiction before choosing an API or another exchange mechanism.