Acin

The removal test is answered by the company's own history: matching and standardising control data across institutions was originally done by industry experts, and a neural network replaced that work because it saves considerable time and effort. A separate agentic tool rewrites controls at scale on hosted language models.

The domain suits it, as the head of customer analytics observes that operational risk exists entirely in a world of language and text, from regulations themselves through to how a process, procedure or policy is written, which is the clearest explanation in this index of why this discipline became tractable only once models could read.

The rewrite tool proposes standardised control language at scale and the institution disposes, with the case study describing a consensus inventory endorsed and delivered by both the first and second lines rather than adopted automatically. Benchmarking output is comparative intelligence for risk officers rather than a decision.

Held at B because no review requirement or approval gate is published for a tool rewriting thousands of controls in days, where the controls themselves are the institution's documented defence to a regulator.

Quantification is the explicit purpose, converting a manual, qualitative and subjective discipline into an automated and quantitative one, with a published score measuring control completeness and an industry index allowing an institution to mark its position against peers. Because the underlying data is standardised under common protocols with unique identifiers, outputs are traceable to definitions rather than to model intuition. Held at B because no accuracy, error rate or validation approach is published for the matching network itself, and the score's construction is not described.

Twelve banks joined the network in its early phase and the company states it is used business-wide at many of the world's most significant institutions, with asset managers added later. One case study is quantified in a way few peers match, describing a bank with multiple global risk frameworks and proliferating regional policies achieving over 30 percent reduction in control volume and more than 60 percent removal of control objectives, endorsed by both the first and second lines of defence. The rewrite tool is credited with saving major banks thousands of hours and millions in cost. Held at B because no institution is named individually anywhere.

This is the rare case where cross-client data sharing is the product rather than an undisclosed side effect, and it is therefore governed openly. The network connects control data from participating institutions under standard protocols expressly to enable anonymised benchmarking and shared collective intelligence, so a member knows its data contributes and knows what it receives in return.

Held at B because no published detail describes how anonymisation is performed, what granularity is exposed to peers, or whether a member can withdraw its contribution, which matter when the shared material is a map of control weaknesses among competitors.

No data protection agreement, retention schedule or subprocessor list was located. Personal data exposure is genuinely low here, because the material is control definitions, risk taxonomies and testing processes rather than customer records, and what the platform holds instead is a detailed map of where an institution's defences are weak, which carries its own confidentiality weight.

No attestation, certification, trust centre or enumerated control set was located. The company describes building on infrastructure it characterises as secure and trusted, which is a statement about its supplier rather than about its own control environment, and the data it aggregates is precisely a catalogue of where participating banks' defences are incomplete.

The reference framework is named, with control designs mapped to risks on the basis of the international banking capital accord, and regulatory mapping is treated as a first-class product because mapping controls to obligations is complex, manual and costly while increasingly demanded by supervisors, delivering regulatory traceability with benchmarking context. Operational resilience is addressed directly. Held at B because no individual regulator, rule or jurisdiction-specific regime is named alongside the framework.

No fairness or governance disclosure was located, and the adapted exposure is structural rather than individual. A network that benchmarks every member against an industry consensus rewards convergence on common practice, which strengthens laggards and also means a blind spot shared across the peer group is validated rather than detected, since a control gap everyone has looks like the standard. Nothing addresses that dynamic or how the consensus is prevented from becoming self-confirming.

No guarantee, indemnity or correction process was located. The exposure is institutional: controls rewritten or removed on the platform's recommendation are the institution's documented defence in an examination or an enforcement action, and nothing describes where responsibility sits if a control eliminated as redundant turns out to have been load-bearing.

The dependency behind the agentic tooling is named directly, covering a major cloud provider's hosted language model service and its accompanying model and tooling platform, so a bank can identify whose models rewrite its control language. The proprietary matching capability is described at technique level as a neural network. Held at B because no model version, base model family or data residency detail accompanies the platform name, and no external data source behind the reference libraries is identified.

The platform provides its own terminal housing digitised data and serving as the window to the network, and no integration with governance, risk and compliance systems, control testing tools or issue management platforms is named. Since institutions already run those systems and control data originates in them, how standardised definitions flow back into the operational environment is not described.

No hosting region, residency commitment or private deployment option was located. The agentic tooling runs on a major cloud provider's hosted model platform, which locates that processing without stating where, and for a network aggregating control weakness data from global banks the residency question is one supervisors would reasonably ask.

The commercial model is stated clearly and unusually: subscription access to data libraries with periodic updates rather than a software licence, and explicitly no consulting services, which tells a buyer what it is not paying for. No price, tier or basis of charge accompanies it, and for a network product the question of what membership costs relative to the benchmarking value received is central and unanswered.

Coverage spans major banks and asset managers, addressing both the first and second lines of defence within them, with use cases running from control standardisation and completeness scoring through peer benchmarking to regulatory mapping. The network model means coverage compounds, since each participant improves the reference data for the rest. Held at B because participation is described only in aggregate and no geographic or institutional breakdown is evidenced.