The AI FinTech Index Brief

The ten days in one line

The agent got the last click. Nasdaq Verafin let its agentic analysts close alerts with no analyst signing off and Carta let fund teams release capital from inside Claude, while Kore.ai, Argos and Spektr fenced the model in at the level of a single field. Socure and Fingerprint started naming the agents at the door, Shufti became the third vendor since late September to sell Know Your Agent, and three wealth vendors turned the meeting note into a new account.

This issue covers October 21 to October 30, and picks up eight entries dated October 20 that reached the log after the last issue went out. The log recorded 80 entries across 80 vendors, 68 Verified against primary sources and 12 Partially Verified. Product changes led with 40, integration work followed with 22, five changed security or compliance terms, five changed how a person oversees or constrains an agent, three were pricing or packaging, two were published performance evidence, two changed a model or the architecture around it, and one was a product sunset. Funding rounds, valuations, and awards are not logged, here or anywhere on this index.

The agent got the last click

Three issues ago the approve button went to work. Last issue the vendors built the disagree button. This period several of them took the button away for certain actions and let the agent finish the job.

Nasdaq Verafin said it has spent the past month rolling out automatic alert dispositioning for its Agentic AI Workforce. An institution can now configure the agentic analysts to clear appropriate alerts on their own, with no analyst signing off, or to escalate them for human review. Recorded Partially Verified. Until now the agent recommended and a person closed. Now closing is a setting.

Carta moved the last step into someone else’s assistant. Workhub in Claude could already start fund workflows and track requests. Fund teams can now release capital activity, approve expense payments, management fees and financial packages, reconcile cash transactions, update valuations and approve the schedule of investments without leaving the chat. Carta says the same safeguards apply as in its web app. The interesting word in that list is release.

SS&C Blue Prism added a batch of WorkHQ connectors, most of them for financial services systems, from Fiserv and FIS to DTCC, Equifax and World-Check One. Each can start a workflow on an event and take actions in the system it connects to. The Jack Henry connector listens for account, customer and transaction events on the jXchange core and can post transactions, transfer funds and issue EFT cards. SS&C asks users to test community connectors end to end and supports them on a best efforts basis.

Alkami put CarletonCalcs OriginationPlus inside MANTL Loan Origination, so calculations, disclosures and compliance checks run in one workflow. Where configured, it can adjust loan terms on its own to keep a transaction inside defined compliance parameters. Loan terms that move without a person acting are a feature a compliance officer will want to read twice. ibl.ai’s Chrome extension now drives a browser tab with real mouse and keyboard events and can click on a point in a picture of the page, so an agent can work inside systems that have no API. Its default Approvals mode is Automatic. The mode that asks before a submit, payment, send or delete is called Ask Me, and a customer has to choose it.

The rest of the period’s agents shipped with a person still at the end of the line, and said so in the release. Sift’s Review Agent reads a fraud case and gives the analyst color coded signals, a plain language explanation and a suggested Block, Accept or Watch. Every Sift AI product starts in assistant mode with the analyst deciding, and customers can later choose which scenarios to automate. Sift says customers report 15 to 20 percent less time on manual review.

Sigma360’s Enhanced Due Diligence Agent gathers internal and external data across modules such as source of wealth and beneficial ownership, and drafts a fully cited narrative. The analyst stays the decision maker, and customers can read the agent prompt behind each step. DataVisor’s Vera Code builds fraud and AML programs through conversation, from event schemas and rules to alert queues and test data, and tests each build before it goes live. DataVisor reports a real time fraud solution for an unnamed Fortune 500 insurer in four days. Recorded Partially Verified. Backbase’s Delivery Factory puts a bank’s delivery team alongside specialist agents for analysis, architecture and backend, mobile and web code, with engineers reviewing every code change. Backbase reports teams delivering twice as fast across more than 10 implementations.

Our read

Sift’s release is the one to study, because it describes the whole path in one sentence. Every product starts as an assistant, and the customer later picks which scenarios to automate. Autonomy is no longer a different product. It is a setting on the same product, and the setting is the upgrade. Verafin has shipped the far end of that path, Carta has put it inside someone else’s assistant, and ibl.ai has made it the default. For a product marketer the default is the positioning statement, whether or not anyone wrote it into the deck.

For the roadmap

If your agent can take the final action, ship three things with it: a published list of the actions it may take alone, a record of each automated action an examiner can read without a support ticket, and a switch that sends any scenario back to a person. Pick the default on purpose and name it in the release note, because a reviewer will find it either way. If you are still assistant only, write down your path to automation the way Sift did. Buyers now ask about the ramp, not just the starting point.

The fence went around the field

While some agents got the last click, other vendors drew the boundary much closer to the model. The unit of control this period was not the agent. It was a field, a threshold or a single word on a page.

Kore.ai’s Artemis platform v1.8.2 lets a builder list the exact session fields the model may write during a reasoning step, instead of only switching model writes on or off. An empty list blocks every model supplied update in that step, while authored logic keeps working as before. In a servicing agent, that means the model can hold the conversation and still never touch the verification flag or the amount.

Argos Identity did the same for AML screening in ARGOS Omni. A workflow step can now fix the match threshold anywhere from 75 to 100, with a default of 85, and fix date of birth matching for person searches. Fixed values override whatever the AI agent sends, and the values actually used are stored in the agent audit log. The agent can still run the screening. It can no longer quietly loosen it.

Spektr went a step further and took the AI out. The prepayment check in Website Sentinel moved from AI based detection to a wordlist scan with a configurable threshold, and each hit records the word, the page and its position. Spektr warns that results can differ from earlier scans. It is a rare release note that trades a model for a rule on purpose, and the reason is plain: a flag that points at a word on a page is easier to defend to an examiner than a score.

FintechOS brought last issue’s disagree button to insurance. Backoffice Insurance 8.1.1 adds an API for authorized underwriters to override automated underwriting results on quotes held for referral. Each override requires a business justification, names the user, keeps the original rule results and creates a new version of the offer. Declined quotes are not covered, so an exception there still needs another route. Bretton changed its quality control scorecard draft so it reviews the whole case, lists specific problems first with a quote from the case behind each, and only then answers the scorecard questions. A reviewer now starts from evidence rather than a suggested score.

The record keeping got finer too. iDenfy’s Sprint 138 marks edited comments as edited, logs every change in the audit trail, and keeps the name and email of departed staff on their past reviews and decisions. Deleted comments drop out of reports and exports, so the question a records manager will ask is whether the audit trail keeps the original. Moveo AI’s new Debts page puts the compliance flags its collections agents capture, such as disputes, in one portfolio view, with a delete button on the same screen. Fiddler Release 26.24 versions evaluation datasets and ties every experiment to the version it ran on, so a validator can rerun a test against the exact set it first used. Blooma changed how Annual GPR flows from rent rolls into linked cash flows and moved existing links to a new default method, so values on existing deals can change without anyone editing them.

Our read

Last issue asked whether a human no changes the agent or only overrules it once. This period added a second question to the spec: what is the model never allowed to touch. Kore.ai answered with a field list, Argos with a locked threshold, Spektr by replacing the model with a rule. Each narrows the agent rather than the user, and each gives a governance team something it can check without reading a prompt. Deterministic is becoming a selling word in the same release notes where agentic is the headline.

For the roadmap

Publish what your model can write and what only your authored logic can write, at the level of the field. Let a customer lock a threshold per workflow step and log the value that was used. And if you replace a model with a rule because the rule is easier to explain, say so in the release note with the reason, the way Spektr did. Taking the AI out of one check is a feature when you explain why.

The bot detector learned names

Last issue the identity vendors stopped arguing with the document. This period the fraud vendors stopped asking whether traffic is human, and started asking which agent it is and who sent it.

Socure added Actor Classification to Digital Intelligence, labeling each transaction as driven by a person, a script, a bot or an AI agent. It also flags account aggregators, search crawlers and personal agents such as Meta’s Muse, and returns the named operator or agent alongside a script risk level. Classification runs per transaction, so when a customer hands a session to an agent halfway through, the handoff shows up.

Fingerprint’s Bot Detection now labels traffic it infers to be Instinct, a personal AI agent that users direct by text message, with a provider, a confidence value and a flag for unknown identity. Instinct logs in with the customer’s stored credentials and relays MFA codes, so on most signals it is the customer. The label lets a bank step up verification on an account change, or rate limit, instead of blocking a real customer’s agent outright. Ravelin launched bot detection for payment service providers that separates unattributed bots from legitimate AI agents at checkout, labels transactions by confidence, and lets a PSP write rules on it across its merchants.

Shufti launched Know Your Agent, which links each AI agent to a person or business verified through its KYC or KYB, and issues the agent a revocable, time bound credential and a trust score. Every request is checked against a mandate of permitted actions, limits and expiry. A request outside the mandate, or above a high risk threshold, triggers a selfie liveness check by the person who authorized the agent. Shufti is the third vendor since late September to ship under the Know Your Agent name, after Baselayer and Sumsub.

Proof added Authentication Classes to Proof Digital ID, so a business sets the level each transaction type requires. Notarization and identity verification keep full biometric authentication, while payments and AI agent actions can clear on lighter methods such as an SMS one time code, all traced to an identity enrolled at IAL2. Read it next to the Instinct entry and the choice of class becomes the product decision worth arguing about. Vouched closed a smaller gap. Its Checkpoint SDKs now claim each accepted signed agent request once, so a captured request cannot be replayed to repeat the action it authorized. Recorded Partially Verified.

Underneath the agent work, the device checks kept tightening. HyperVerge added emulator detection to the web capture mode of its Flutter SDK, with a named flag and error code for every session it ends. OneSpan’s app shielding for Android 9.2.0 now detects Frida injection, Vulkan layer injection and container emulators, with code injection detection on by default. Persona shipped a hardened build of its iOS SDK with runtime app protection that links in with no source changes, though the changelog does not say what it detects. GBG added a face uniqueness check so one face holds one account at sign up, with the same check available as a step up after a device change or an unusual withdrawal.

Our read

The fraud stack is being rebuilt around a third party that is neither the customer nor the fraudster: the customer’s agent. A bot score had two answers. An actor class has a list, and the list now has names on it. That changes what the product returns, from a block decision to a label the bank’s own rules consume, and it changes the pitch, from keeping machines out to letting the right ones in. Know Your Agent is turning into a category name faster than it is turning into a standard, so the differentiation will sit in the mandate model and the step up, not in the name on the slide.

For the roadmap

Return the agent as a named value, not a yes or no, and design the allow path as carefully as the block. If you verify agents, publish how a mandate is written and what triggers the step up. If you authenticate them, say which actions can clear on a one time code and why, because the next entry in this log may be an agent that relays the code.

The meeting note became a new account

Last issue a notetaker closed its doors in the same week a rival shipped two integrations. This period three wealth vendors carried the meeting all the way into the paperwork, and two of them went straight to the custodian.

Nitrogen began rolling out Nucleus Account Opening, which lets advisors start, submit and track new Charles Schwab accounts inside Nitrogen on Schwab’s new account opening APIs. The agent prefills from client and household data, and when Schwab opens the account the number flows back and reconciles on its own. The advisor reviews, confirms and submits every request. Zocks launched Account Opening, which fills and validates applications from intake meeting data, CRM records and documents, then sends them through Schwab Advisor Center’s digital onboarding for the client to authorize. It covers Schwab One brokerage and traditional, Roth, rollover and inherited IRAs.

Zeplyn introduced Workflows, which turns a firm’s operating playbooks into multi step processes, starting with advisor transitions, client onboarding and account opening. Agents decide next steps within set boundaries, fixed rules validate the data, and each workflow pauses at approval points the firm defines. Schwab is the only custodian with direct submission for Nitrogen and Zocks so far, which says a good deal about whose APIs this race is running on.

The assistant side moved in the same week. Jump released eight prebuilt Claude skills that work from an advisor’s meeting transcripts, notes, documents and tasks, and its read only connector now installs as part of Anthropic’s Claude for Financial Advisors plugin. Conquest released an MCP connector that brings its SAM planning engine into Claude for Financial Advisors, where an advisor can check goal progress, create client files, and update plans or apply strategies from the chat. Conquest says the results come from a deterministic calculation engine. One connector reads. The other writes to a live plan, which makes its confirmation step the feature to test.

AdvisoryAI’s Atlas now reads client emails in Outlook, limited to messages that include a known client address, and firms that connected before October have to reconnect and approve the new permission. Dynamic Planner released an agentic upgrade with live Microsoft 365 and Zoom connectors, full fact find write back to Intelligent Office, and a license to build client journeys on its data and risk models, without saying what the connectors do or what the license costs. FE fundinfo added Monte Carlo stress testing to the UK gross cashflow modeler in FE CashCalc, 10,000 simulations on the figures already in the plan, included in existing subscriptions.

Then there is the skill, which is quietly becoming the unit of the product. Marloo launched Skills, saved instructions that run a repeated task with one command, and says more than 50 firms built nearly 300 of them in testing. Jump’s eight are skills too. And AllMind said it will retire Reports in early November and move report workflows to Agent Studio and Skills, with Financial Models and Screener temporarily unavailable and no return date. A report is a screen a vendor designed. A skill is an instruction the customer wrote. AllMind is retiring the first in favor of the second.

Our read

The wealth AI lane has moved downstream from the conversation to the operation. A year ago the meeting note was the product. Now it is the input, and the product is whatever the note fills in: an account application, a plan update, a workflow step. That raises the stakes in a way the notetaker category may not enjoy, because a wrong note was an embarrassment and a wrong account registration is an operations ticket with the client’s name on it.

For the roadmap

If your product starts from the meeting, decide what it finishes. Custodian APIs are the moat of the moment, and Schwab opened first. Ship the validation before the submission, and put the advisor’s approval where a supervisor can see it. If your customers are writing skills, give them versions and an edit permission, because a firm’s shared skill is a procedure, and procedures get audited.

Market notes

The connectors kept arriving, and now they arrive in more than one assistant at once. Verisk added Amazon Quick and Microsoft Copilot access to ISO Loss Costs and PAAS content, extended its Claude integration to PAAS, and added a Benchmark connector in Claude for property level hail and wind history. S&P Global added an MCP server to iLEVEL for tools such as Copilot and Claude under existing iLEVEL permissions, alongside a native iLEVEL Agent. Narmi picked Microsoft 365 Copilot for a read only connector to its banking platform. Aptus.AI sends cited, in force legislation and case law into Claude through a read only connector included in its Enterprise plan, recorded Partially Verified. Hebbia now reads a firm’s own Databricks data in place with per user sign in, and Model ML connected to Harmonic’s startup data over MCP for firms that hold a Harmonic license. Which assistant to ship into used to be a technical question. Verisk’s release reads like a channel strategy.

Three vendors changed how they charge, and all three put a number in the release. Outmarket AI launched Lite, a self serve tier an insurance agency can sign up for and use the same day with no sales call, starting at $1,000 per seat per year. AMLBot cut its lineup to two plans, a pay per check Personal plan with credits from $1 down to $0.10 and a quote only Business plan, and says both run the same risk scoring. FICO said it will hold its wholesale mortgage price at $10 for a bundle of Classic FICO and FICO Score 10T through tri merge resellers, for lenders in its Preferred Program, without spelling out what enrollment requires.

In mortgage and lending, Blend now runs Freddie Mac’s Loan Product Advisor automatically when a borrower submits a full application and the credit pull completes, matching its existing Desktop Underwriter run, with refinances and some VA purchases still manual. TransUnion launched synthetic fraud and credit washing scores that carry adverse action reason codes, and named Oscilar as the first risk platform to run them alongside credit decisioning. A fraud score written to be explained to a declined applicant is a new kind of fraud score. DigiFi added four Jack Henry SilverLake integrations that create the customer, loan account and collateral records in the core from origination. LendAPI added Branches, so a lender can scope staff, applications and reporting by location, recorded Partially Verified.

The document work kept moving into the data pipeline. Cardo AI made its extraction engine a data source in its onboarding platform, so servicer reports and borrowing base certificates become typed rows that link back to the page they came from. Codat rebuilt Intelligent Upload into one guided screen for businesses whose accounting software has no connector. Advocate released AIR in beta, an invite only agent that builds a program’s insurance requirements through conversation instead of field by field entry, recorded Partially Verified. K1x added an Investor Portal for delivering K-1 packages from the same tool that builds them.

Tokenized money got some plumbing in the same ten days. Credora published an indicative A+ rating for JPMD, J.P. Morgan’s tokenized deposit issued through Kinexys, itemizing ten token modifiers on top of the bank’s own default probability, and states that it is not a nationally recognized statistical rating organization. Jack Henry documented an API for receiving digital asset payments into accounts, recorded Partially Verified, without saying who can use it yet. Scorechain added Circle’s Arc as its 26th blockchain, where settlement in under a second means screening has to happen before the payment rather than after. Bloomberg mapped crypto and tokenized exposure, including exposure held inside funds and bonds, to the Basel Committee’s crypto asset groups, with explainability fields so a client can challenge each classification. And prediction markets, which turned up in an underwriting model in late September and a personal trading policy last issue, now sit on Broadridge’s CQG front ends and APIs as Kalshi event contracts, next to futures and options.

In financial crime the clock got shorter. Fenergo added an optional second Ongoing Screening run 12 hours after the first, so a sanctions update issued after the morning run is caught the same day. Napier AI connected Transaction Screening to LSEG’s World-Check On Demand API, screening payments against new list data within minutes of publication, with firms choosing which rails and risk types need the check. Bits added goAML suspicious activity and transaction report filing for Sweden and Finland, prefilled from the entities already in the investigation. Middesk took International Business Verification past 65 countries and into Latin America for the first time, without publishing the country list. MyComplianceOffice now takes in WhatsApp, WeChat, LINE, Telegram and SMS messages recorded through LeapXpert, so off channel messages land in the same program as trading and conflicts.

Insurance had a full release cycle. Insurity’s Dorado release led with the Ratio Content and Rating Engine, which turns machine readable bureau rates, rules and forms into production rating logic. Earnix added an Online Testing Hub for checking pricing and underwriting rules in staging, and single request rating across packages and states. Socotra added Policy Continuations in beta, issuing a new policy built from the old one where a normal endorsement cannot reach. Convr extended its underwriting workbench to cyber. Renew Risk extended its severe convective storm model for solar farms to all 48 contiguous states, adding tornado and straight line wind to the hail it modeled first. Vertafore made its Velocity Coach Agent available in AgencyOne, answering how to questions from Vertafore’s documentation and an agency’s own procedures.

The numbers this period came with fewer methods than last. Glia’s assistant at University of Kentucky Credit Union now handles about 58 to 60 percent of calls, with 47 percent containment against 5 percent on the system it replaced, figures the credit union gave in an interview and recorded Partially Verified. CUBE reported that CMC Markets spends 50 percent less time on regulatory monitoring, with no stated method. Vertafore’s up to 88 percent faster answers come from internal testing. Sigma360’s up to 87 percent is a design target, which the release says plainly, and a design target is a different kind of number from a result. RavenPack labeled 845,220 excerpts in about 49 minutes on two GPUs with an open weights Nemotron model it says regulated firms can run in house, which makes it a model supply chain disclosure as much as a benchmark.

Two vendors announced ISO/IEC 42001 certification for their AI management systems. Incode named the accredited certification body, the scope across its Omni platform, the issue date and the expiry, and put the certificate in its Trust Center. Encompass Corporation announced its certification without naming the body, the date or the scope, recorded Partially Verified. Same standard, very different amounts of evidence, and only one of them can be checked by a procurement team without sending an email.

The rest were small and useful. Rulebase now lets teams share and export Insights reports as Word, PDF or Markdown. Taktile launched Insights, plain language questions over a lender’s or insurer’s decision data, with charts that pin to a shared control tower. Tyfone added a prebuilt Pocketnest financial wellness integration, live first at ELGA Credit Union, recorded Partially Verified. AI Rudder moved its HubSpot connector to Calls API v2 ahead of v1 retiring on December 31, 2026.

What the ten days say about the space

Eighty entries, and the thread running through them is a trade. The agents got more of the final action, and the vendors drew the boundary in finer detail to pay for it. Verafin, Carta and SS&C extended what an agent may do alone. Kore.ai, Argos and Spektr narrowed what the model may touch. Socure and Shufti began naming the agents on the other side of the door. The wealth vendors carried the meeting all the way to the custodian.

For the people who build and market in this category, that trade is the story to position against. Autonomy sells the demo. The boundary sells the renewal. The vendors who win the next procurement cycle will be the ones who can show both on one page: what the agent finishes, and the field it is never allowed to touch.

The last issue ended with vendors writing down what happens when a person disagrees with the rule. This period they started writing down what happens when nobody is asked. That document has one paragraph missing almost everywhere, and the Index Answer below is about that paragraph.

Index Answer

Which financial services AI vendors say who answers when the AI is wrong?

Almost none, and the gap matters more each time an agent gets the last click. Of the 610 vendors the AI FinTech Index has graded on AI Liability and Recourse, 8 reach the top grade. That grade takes a commitment that makes the vendor answerable when the AI is wrong, a guarantee or an indemnity running toward the customer. Another 43 publish something falsifiable short of that, such as an accuracy figure with its method, or a real route for the person affected, like a second check instead of a silent denial.

The remaining 559 sit in the bottom bands. 515 publish the machinery of challenge, audit trails and source traceability, with nothing standing behind the output and no route for the person affected, and 44 publish nothing at all on who bears the loss. No other axis in the index has more vendors in its bottom bands.

Set that against the oversight axis, where 108 vendors reach the top grade by publishing what the system runs alone, what constrains it and how a person checks it. This market has learned to describe the control in detail. It has not learned to say what happens after the control fails. An audit trail answers what happened. It does not answer who pays.

This period’s log puts names to the gap. Nasdaq Verafin’s agentic analysts can now close an alert without an analyst, and an alert closed that should have been escalated becomes the institution’s compliance failure, on terms Verafin does not publish. Carta’s Workhub in Claude can now release capital activity, while Carta’s published material disclaims liability for reliance on the information it provides. The exception in this issue is Glia, which guarantees in contract that its assistant will not hallucinate or fall to prompt injection. That moves generative failure from a disclaimer the customer absorbs to a term the vendor answers for. Proof sits in the second band for a reason older than AI: a notarization has a named notary behind it, carrying personal liability and usually a bond.

For a product team this is the next paragraph procurement will ask for, and the one almost nobody has written. Autonomy without recourse is a sales conversation that ends in the legal review. The second band is within reach of most vendors in this log: a measured error rate with its method, or a route for the person the agent got wrong. A vendor that publishes either will have the only answer on the page.

The full grading method and what separates each band are on the capability framework page.