Methodology

The AI FinTech Index assesses each vendor across fifteen structured capability axes organized in four groups: AI capability (AI centrality, autonomy and oversight model, model risk management and transparency, operational and outcome evidence, AI safety and data stewardship), regulatory and compliance (GLBA and data privacy posture, security certifications, regulatory status and licensure, AI governance and bias disclosure), integration and deployment (core systems and integration depth, deployment model and data residency), and commercial (commercial transparency, institution and segment coverage). These axes were selected based on the decision criteria most frequently cited by chief risk officers, chief compliance officers, heads of fraud, and technology leaders at financial institutions during vendor shortlisting, with particular weight on the questions AI products raise that conventional software does not.

Each axis receives a letter grade. A grade reflects the assessed strength of the vendor’s offering on that axis, not a comparison to other vendors. Grades are not aggregated into a composite score; the index holds that no single number can responsibly summarize a financial services AI vendor’s suitability across disparate institutional and regulatory contexts.

Vendors are added to the index when they meet a minimum threshold of publicly available information. The absence of a vendor from the index does not constitute a negative assessment.

Every vendor in the index carries a grade on all fifteen capability axes. There are no gaps. A reader comparing two records is comparing the same fifteen questions, answered for both, which is what makes a comparison meaningful rather than an artifact of which vendor happened to be researched more thoroughly.

This is a commitment about coverage, not about certainty. Many vendors publish little on some axes, and a grade records what a counterparty can actually verify rather than what the index assumes to be true. Where evidence is thin, the assessment says so plainly, states what was searched and not found, and names the questions a buyer should put to the vendor directly. A low grade is a statement about the available evidence, not a finding that the underlying control or capability is absent.

Where an axis does not apply to a product, the assessment identifies the framework that governs instead rather than penalizing the vendor for failing a test that was never relevant to it. A product that never touches cardholder data is not marked down for lacking a PCI DSS attestation, and a European vendor is not marked down for lacking a United States charter; the record names the standard or regime that applies in its place. Scoping an axis honestly is more useful to a buyer than recording it as a gap.

A vendor whose assessment is incomplete is not published. Rather than appearing as a partial record, it is withheld until every axis is graded. This is enforced mechanically rather than by intention: the site cannot be built while any record carries an ungraded axis, and incomplete records are excluded from the sitemap so they cannot be surfaced through search.

Before an absence of evidence is recorded, the vendor’s own published surfaces are searched more than once. Trust centers, security pages, privacy policies, terms of service, and pricing pages frequently carry disclosures that product marketing does not, and a single unsuccessful search is treated as an incomplete search rather than as a finding.

The index covers companies that sell financial technology to organizations, where the product has a real artificial intelligence capability. Consumer finance apps, banks and other financial institutions themselves, investment firms, and general purpose technology companies that merely have financial services customers are outside its scope. Where a company applies AI internally to run its own trading, lending, or insurance book rather than selling software, it is treated as a financial institution and excluded.

Inclusion is by product, not by company. Where a company sells several lines of business, the record covers the AI products relevant to financial services and states plainly what is excluded. A data company is indexed for its risk decisioning software and not its data licensing business; a company with both financial and non financial divisions is indexed only for the financial services products; a company that pairs software with its own regulated lending or servicing operation is indexed for the software, with the regulated operation disclosed.

The same product scoping applies to core banking vendors, card networks, and other established platform companies. A core platform is not itself an AI product, and the presence of AI features inside a platform does not by itself create a record. Where such a company sells a distinct AI product, that product is indexed on the same terms as any other, with the platform treated as context rather than as the subject of the record. The AI Centrality axis then reports honestly on how central the model is to what a buyer is actually purchasing, which is the material question when weighing an incumbent bundled capability against a specialist tool.

A grade of C or lower on AI Centrality is not a criticism. It is a factual statement that the AI is a layer on a product whose value stands substantially without it, which is information a buyer needs when comparing options that are priced and procured very differently.

A record exists to support a buying decision, so a product must be far enough along that a reader can act on it. Commercially available products qualify. So do products in supervised pilots or limited availability at named institutions where the path to general availability is disclosed, since an organization planning a program needs visibility into what is coming and from whom. Products at prototype stage, or where the company itself projects first revenue in a future year, are not indexed. This is not a judgment about the technology or the team. It is a judgment about whether publishing a record would imply to a reader that something can be evaluated and purchased when it cannot.

AI Centrality assesses whether artificial intelligence is the product itself, the engine of a core module, or a feature layer on a platform whose value stands without it. The index includes companies across this full range; this axis is how readers distinguish an AI-native product from a platform with AI capabilities.

Autonomy and Oversight Model assesses what the AI is permitted to do (draft, decide, or act) and how rigorously the vendor discloses its human oversight structure, including escalation thresholds and override paths, and the boundary between what the system decides alone and what a human reviews. The axis grades disclosure rigor, not autonomy itself: high autonomy with a documented oversight model can grade well, while any autonomy with no disclosed oversight grades poorly.

Model Risk Management and Transparency assesses disclosure of what is under the hood and how it is validated: proprietary models versus fine-tuned foundation models, training data claims, model cards, versioning and update practices, and the documentation a buyer needs to satisfy its own model risk management obligations under SR 11-7 and equivalent supervisory guidance.

Operational and Outcome Evidence assesses the strength of evidence behind performance claims, from independently validated results measured against a named baseline at the top of the scale down to outcome percentages published with no methodology. Detection rates, false positive reductions, straight through rates, and loss figures are recorded with their measurement basis. Vendor-reported statistics are always recorded as vendor-reported and are never restated as independent results.

AI Safety and Data Stewardship assesses how the vendor handles customer financial data and personal information across the AI lifecycle, including use in model training, retention, cross-client separation, and de-identification, along with safety engineering disclosures such as guardrails and incident reporting.

GLBA and Data Privacy Posture assesses how the vendor supports the buyer’s obligations for nonpublic personal information: GLBA Safeguards alignment, contractual data protection commitments, subprocessor disclosure, and coverage of the privacy regimes that apply to the product’s data flows.

Security Certifications and Trust Center assesses SOC 2 Type II, ISO 27001, and PCI DSS status where card data is in scope, verified through public trust centers wherever possible, along with security incident disclosure practices.

Regulatory Status and Licensure records the regulatory posture of the product and the entity behind it: registrations, charters, and licenses where the vendor itself performs regulated activity, and the clarity of the vendor’s positioning about which regulator’s perimeter the product operates inside when sold to a regulated buyer, including EU AI Act high-risk classification where it applies. Status is verified against public regulatory databases and filings. The axis grades the clarity and appropriateness of the vendor’s regulatory positioning, not the possession of a license; products for which licensure is not applicable are not penalized.

AI Governance and Bias Disclosure assesses substantive responsible AI commitments: published model cards, bias and fairness evaluations with stated methodology, fair lending and disparate impact testing for credit-adjacent models, adverse action explainability, and third-party AI audits.

Core Systems and Integration Depth evaluates integration maturity with the systems financial institutions actually run, covering core banking platforms, card networks and processors, loan origination and servicing systems, market data and custodial platforms, and open banking APIs, verified against integration documentation and named marketplace listings where available. For segments where core integration is not the relevant surface, the axis is assessed against the relevant integration surface or marked not applicable.

Deployment Model and Data Residency assesses documented deployment options (cloud, virtual private cloud, on-premises) along with data residency commitments and tenant isolation disclosures, read against the outsourcing and third-party risk expectations that regulated institutions must apply to their vendors.

Commercial Transparency assesses whether a buyer can learn what the product costs and how it is priced without a sales engagement: published tiers, published pricing basis, and self-serve trial availability. Specific figures are recorded in the vendor’s pricing record, with estimates labeled as estimates. Vendors that publish no pricing are recorded as Contact the vendor and graded on what a prospective buyer can establish before making contact; a failing grade is reserved for published pricing claims contradicted by evidence.

Institution and Segment Coverage assesses clarity about which institutions and segments the product is validated to serve (banks by asset tier, credit unions, fintechs, broker-dealers, asset managers, insurers, merchants) and which product lines within them. Narrow coverage clearly stated grades well; the measure is clarity and validation, not breadth.

A comparison page places two vendors side by side on the same fifteen axes. It introduces no new grades. Both columns are the vendors’ existing records, rendered together, so a comparison cannot say anything about a vendor that its own profile does not already say.

Each comparison carries a written verdict and two conditional lists: the buyer circumstances under which the first vendor is the better choice, and the circumstances under which the second is. The verdict is a judgment, and it is written as one. It is not a ranking, a winner, or a score, and the index does not publish a preferred vendor per pair. A comparison that could only be resolved by knowing a specific buyer’s constraints says so rather than manufacturing a verdict.

Pairs are selected where a buyer would plausibly evaluate both products against the same requirement, which usually means shared category membership and overlapping institution segment. A pair is not created to generate a page. Where two vendors do not genuinely compete, no comparison is published.

A comparison inherits the verification date of the records behind it. Where one of the two records has been re-verified more recently than the other, the comparison reflects the earlier date, because a side by side is only as current as its stalest column.

Vendors are welcome to contest a verdict. A contested verdict is reviewed against the same evidence standards as any other submission, and where the evidence supports a change, the verdict is rewritten and the verification date reset. Disagreement alone does not change a verdict, and no verdict is altered in exchange for anything of value.

Every data point in the index carries a source basis. There are five categories: Vendor Published, Peer Reviewed Publication, Financial Institution Interview, Third Party Estimated, and Regulatory Filing. The source basis is displayed alongside every grade, price, and claim.

Vendor Published indicates data sourced from the vendor’s own documentation, website, or public statements. This is the most common source basis for descriptions, pricing models, and integration claims. Vendor-published data is recorded as stated but is not independently verified unless corroborated by another source.

Peer Reviewed Publication indicates data drawn from research published in a peer reviewed venue, recorded with the study named. Financial Institution Interview indicates data gathered through structured interviews with staff at institutions that have deployed or evaluated the vendor’s product. These sources are anonymized, and interview-sourced data is treated as primary evidence, carrying greater weight than vendor-published claims where the two conflict. The interview category is defined in the index’s data model but is not yet in use: no interview-sourced data is currently published.

Third Party Estimated indicates figures derived from third-party sources such as industry analyses, procurement records, or comparable deployments, none of which have been confirmed by the vendor. These figures are always labeled "Estimated" in the interface and accompanied by disclosure notes describing the estimation basis.

Regulatory Filing indicates data sourced from public regulatory databases and filings, such as SEC and FINRA registration records, state licensing databases, and securities filings. Regulatory filing data is factual and independently verifiable.

When a pricing figure or capability assessment is labeled "Estimated," it means the AI FinTech Index has derived this figure from sources other than the vendor’s own disclosure. Estimated figures are presented to provide directional guidance and are never represented as confirmed.

Estimated pricing is typically derived from one of three methods: analysis of publicly available procurement records, extrapolation from comparable vendors with published pricing in the same category and segment, or information provided by financial institution procurement staff under condition of anonymity.

Estimated figures carry an inherent margin of uncertainty. The index recommends treating any estimated price as accurate within a range of plus or minus thirty percent of the stated figure. Where the estimation basis is particularly thin, the figure is withheld rather than published with a wide confidence interval.

Vendors are invited to confirm or correct estimated figures. When a vendor confirms an estimated figure, the source basis is updated to "Vendor Published" and the "Estimated" label is removed. When a vendor disputes an estimated figure but does not provide a confirmed alternative, both the estimate and the dispute are noted.

Every vendor record in the index carries a "Last Verified" date. This date indicates when the record was most recently reviewed against its sources. A record may be re-verified without any change to its content, confirming that the existing data remains accurate.

Verification follows a documented cadence: records are reviewed at minimum every one hundred eighty days. Records containing regulatory registration or licensure status are reviewed every ninety days, as regulatory status can change. Records where all data is vendor-published and no third-party corroboration exists are flagged with a reduced confidence indicator.

When a material change is detected, such as a new regulatory registration, a change in pricing model, a security incident, or a corporate acquisition, the record is updated outside the normal cadence and the "Last Verified" date is reset. The previous version of the record is not retained in the public interface. Product and capability changes at indexed vendors are published separately in the change log, each with a cited source and an assessment of buyer impact.

The "Last Verified" date on a record does not guarantee that every data point within the record was independently confirmed on that date. It indicates that the record was reviewed and that no material changes were identified. The source basis for each individual data point indicates the strength of evidence for that specific claim.

The AI FinTech Index publishes independent ratings of AI vendors for banks, insurers, lenders, wealth managers and capital markets firms. It independently rates each vendor from public evidence alone, and the independent research behind a rating is the vendor’s own documentation, trust center, regulatory filings and published material rather than a customer survey, an analyst briefing, or a paid submission.

The AI FinTech Index accepts no payment from vendors for inclusion in the index, for placement within the index, for grades or assessments, or for expedited review. No vendor can purchase a favorable comparison outcome or the removal of a negative assessment.

The index does not currently sell any product or service to the vendors it covers. If commercial products are introduced in the future, they will be kept structurally separate from editorial assessment, and this methodology will be updated to disclose the funding model before any such product launches.

Vendors may submit corrections, additional sources, or requests for re-assessment. These are reviewed against the same standards applied to all data. A vendor submission that is accepted as a source is labeled accordingly. A vendor submission that is rejected is not acted upon, and the rejection is not published.

The editorial team reserves the right to decline or remove a vendor listing where a vendor is found to have misrepresented its capabilities in communications with the index, or where a vendor attempts to influence assessments through channels other than the submission of verifiable evidence.

The AI FinTech Index is a reference tool, not a regulatory body, procurement advisor, or legal authority. Assessments reflect the editorial team’s best judgment based on available evidence at the time of verification. They do not constitute an endorsement, a recommendation, or a guarantee of performance.

The index cannot evaluate a vendor’s performance within a specific institution’s environment. Capability grades reflect the product’s design and stated capabilities, not its realized performance in deployment. Institutions should treat the index as a starting point for due diligence, not a substitute for it.

The index does not assess contractual terms, service level agreements, or vendor financial stability. These are critical procurement considerations that fall outside the scope of this reference. Institutions should engage qualified legal and financial advisors for these dimensions.

AI in financial services is a rapidly evolving field. A vendor’s capabilities, regulatory status, and pricing may change between verification cycles. The index recommends that users always check the "Last Verified" date and consult primary sources before making procurement decisions.

If a grade, price, integration claim, or regulatory status on your record is wrong or out of date, send the correction with a source and it will be reviewed against the standards on this page. Corrections that are accepted update the record and reset its verification date. Nothing about this process is purchasable, and submitting a correction does not change how a vendor is graded on anything else.

The most useful submissions point at a specific axis and a specific published source. Trust centers, security pages, model cards, regulatory registration numbers, and pricing pages carry more weight than a narrative summary.

Submit a correction→