CleverChain

The removal test is unusually clean here because the company owns no data. It describes itself as source agnostic, drawing commercial, registry and open source material from third party providers, which means the entire value it adds sits in what it does with that material: normalising it, linking entities, reasoning across the connections and producing a policy calibrated conclusion. Strip the models and nothing sellable remains, only a pipe to somebody else's data.

The company states the distinction itself, that most tools in this category run checks while its own product delivers intelligence. Compare the orchestration platforms in this lane, where removing the models still leaves a working workflow engine.

Two published controls sit around a deliberately autonomous product, and they are better than most in this lane. The agent works to the institution's own policies, procedures and questionnaires rather than to vendor defaults, which keeps the standard being applied under the customer's control, and audit logs plus quality assurance checks are described as part of the process rather than as optional additions.

What is not published is the shape of human involvement: no review gate, no escalation threshold, no sampling rate and no account of who signs a conclusion before it enters a compliance file. The company also states its direction openly, toward agents that monitor, investigate and resolve risk without intervention, which makes the missing detail more consequential rather than less.

Traceability is designed into the product rather than offered as a report. Investigations are described as evidence backed with transparency at the level of each investigative step rather than only in the finished assessment, audit logs and quality assurance checks run as part of the process, and explainability is one of the criteria under external regulatory examination.

That gives a reviewer a path from a conclusion back to the material that produced it, which is what supervisory expectations on model use actually require. It falls short of an A because performance is never quantified anywhere: no accuracy rate, no false positive or false negative measure, no validation methodology and no revalidation cadence.

Independent recognition is the strongest part of this profile and it comes from more than one house across more than one year: a leading financial crime analyst firm named the product best in its business verification category in both 2024 and 2025 and published a vendor profile with two separate category awards, a second analyst house named it best innovation in its category in 2025, and it placed near the top of a national regulatory technology ranking.

A global credit bureau entered a strategic partnership to carry the capability to its own business customers, which is a commercial party staking distribution on it. What is entirely missing is the other kind of evidence: no client is named anywhere, no client count is published and no quantified customer outcome appears.

The published architecture makes data movement central and never describes its limits. Being source agnostic means client cases are enriched from external commercial, registry and open source providers, and cross ecosystem orchestration is named as the company's operating model, so material crosses several boundaries during a single investigation.

Nothing published states which providers receive what, whether an institution's own policy definitions or investigation history are used beyond that engagement, or whether findings assembled for one institution inform the risk graph another institution sees.

Due diligence at this depth is personal data work as much as corporate data work, since establishing ownership and control means assembling identified individuals, their relationships across entities and open source material about their behaviour into a continuously updating graph. Searched the platform and company material for a privacy statement, a lawful basis account, retention terms, or any description of how individuals appearing in a risk graph are treated, and located none. The open source element makes this more pointed than for registry only vendors, because material gathered from the open web about a named person carries obligations the person never agreed to.

Searched the company, product and partnership material for an enumerated attestation, an information security standard, a penetration testing statement or a trust centre and located none. The company does publish a collaboration with a nationally qualified cybersecurity specialist, but that arrangement is described as strengthening what clients receive rather than as any assessment of the company's own environment.

For a vendor holding due diligence files and beneficial ownership graphs on behalf of top tier banks, which run formal vendor security assessments as a condition of doing business, the answer plainly exists in private and not in public.

This is the strongest regulatory position located in the index so far and it is a different kind of fact from a compliance claim. The company participates in the United Kingdom conduct regulator's regulatory sandbox, which means the product is being tested in a live environment with the regulator providing oversight and guidance, and the reported scope of that test is the artificial intelligence due diligence capability itself measured against transparency, explainability and freedom from bias.

Elsewhere in this index the highest marks on this axis go to vendors that passed an access or enrolment process. Here a financial regulator is examining the reasoning system that this index exists to evaluate. The founding team also claims prior regulatory recognition for an automated perpetual due diligence deployment at a large European retail bank.

Bias is addressed by submission to outside examination rather than by assertion, which is rare on this axis. The regulatory sandbox test is reported as measuring the due diligence capability against freedom from bias alongside transparency and explainability, meaning a supervisor is looking at the question rather than the vendor answering it about itself.

That matters in a product where an adverse conclusion can deny a business banking access, and where open source material and name matching carry known disadvantages for non Latin names, common surnames and businesses in jurisdictions with thinner registries. It stays at B because nothing about the outcome is published: no methodology, no findings, no error analysis by jurisdiction, name form or entity type, and no fair treatment commitment of the company's own.

The output is a due diligence conclusion that a regulated institution files against a legal obligation, which makes the consequence of an error supervisory rather than merely commercial. A missed beneficial owner or an unnoticed sanctions exposure becomes the institution's breach, not the vendor's, and an adverse conclusion denies a business access to banking with no route back to the party that produced it.

Nothing published states a warranty, a service level, a correction obligation or any allocation of responsibility, and no disclaimer was located confirming that the compliance decision remains the institution's own.

The company is precise about its data supply chain and silent about its model supply chain, and the contrast is striking within one profile. Being source agnostic is presented as a headline feature, with clients able to keep their own providers, so a buyer can see exactly where the information comes from. Nothing states where the reasoning comes from.

Three agents are named as products without any indication of the models beneath them, whether they are built in house or called from an external provider, or whether case material including named individuals passes to a third party during an investigation.

The architectural stance is stated clearly and is commercially sensible: infrastructure agnostic, designed to plug into an institution's existing stack rather than replace it, and source agnostic on the data side so an institution can keep the providers it already pays for. The credit bureau partnership is a genuine distribution and data channel, and live registry connections are described. What holds this below the leaders is specificity.

Beyond that one partner and a regional cybersecurity collaborator, no named integration with a core system, case management platform or onboarding product appears, and no developer facing interface or documentation surface was located.

Searched the platform and company material for a deployment description, hosting regions, a residency commitment, a single tenant option or any account of where investigation records and risk graphs are held, and located none. The omission carries weight given the customer base, since European banks and Monaco and Gulf facing institutions are exactly the buyers most likely to require data location terms by contract, and since a source agnostic architecture necessarily moves case material to external providers whose own locations are equally unstated.

Searched the platform, product and company material for rates, tiers, a billing basis or any indication of what drives cost, and located none. The gap is sharper than the category norm because the product is described as an autonomous agent performing investigations, which is a unit that could reasonably be priced per entity, per investigation, per monitored relationship or per seat, and those scale very differently for an institution running continuous monitoring across a large customer book.

Three buyer types are stated plainly, financial institutions, industrial groups and risk consultancies, and the company describes its customers as major financial institutions and highly regulated organisations across Europe including top tier banks.

Functional coverage spans customer due diligence, business verification, anti money laundering and supplier risk in one platform, and the credit bureau partnership is explicitly aimed at businesses operating internationally with cross border ownership structures. Coverage stays at B rather than higher because none of it is quantified: no client count, no jurisdictional list, no registry coverage figure, and the geographic centre of gravity is clearly European.