Tracking changes to AI fintech vendors

Sumsub launched a KYA Module for MCP, a filtering layer between a business's AI agents and the data sources they connect to. It screens each agent request, strips personal and other sensitive data before it reaches the agent, keeps an agent activity log, and can require a live human verification when an agent attempts a flagged action. It works first with Amazon Bedrock AgentCore Gateway.

Our read

Banks and fintechs deploying their own agents get a way to cap what those agents may do alone and to require a verified person for high value actions. Support starts with one gateway, so buyers on other stacks should confirm timing.

Sumsub launched Workforce Verification, which brings document checks, biometric liveness and background screening into enterprise identity and HR platforms. It triggers checks at high risk moments across the employee lifecycle, from hiring to help desk account recovery, and works with tools such as Okta and Ashby.

Our read

A password or MFA token proves someone holds a credential, not who they are, and help desk account recovery is where deepfake social engineering is landing. For banks, this moves Sumsub from customer onboarding into protecting the institution's own staff access.

Sumsub released a Brazil-localized onboarding solution for betting platforms that retrieves identity data and a document image from local databases through local partnerships, so a player supplies a CPF number and a selfie liveness check rather than photographing a document. Sumsub states the retrieved IDs and biometric evidence are retained in the dashboard for audit purposes and that retrieval requires explicit user consent under the LGPD.

Our read

Brazil's regulated betting market is new enough that compliance requirements are still settling, and buying a localized path is a bet that operators would rather buy the interpretation than maintain it. Removing the document upload also removes the operator's own copy of the capture, so confirm what the retained audit record actually contains before a regulator asks. The recurring failure mode for jurisdiction specific products is how quickly they are updated when the regulator moves.