CSI

A sixty year old core processing business with a financial crime artificial intelligence line attached in 2025. The removal test leaves nearly everything standing: the core banking platform, digital banking, lending, payments including instant settlement, treasury management, account origination, managed cybersecurity, managed information technology, an outsourced call centre and document distribution are all deterministic services that predate the models by decades and generate the revenue.

The learned components are recent and narrow, consisting of an anti money laundering and fraud detection pair launched in April 2025, a teller facing check fraud capability, and published thinking on conversational artificial intelligence. The financial crime products are also built on a partner's engine rather than the company's own, so even within the artificial intelligence line the modelling is bought in. This is a core provider that has added artificial intelligence products, and the ordering matters for anyone comparing it against vendors whose entire business is a model.

The framing is assistive and the boundary is undescribed, which for an anti money laundering product leaves the central question open. The detection product is presented as seamlessly integrating into a bank's compliance team and instantly providing support and protection, language that positions it alongside human analysts rather than in place of them, and nothing published claims autonomous decisioning. But nothing published defines it either.

Across two passes no statement was located on whether alerts are closed automatically, what confidence threshold governs any automated disposition, what a compliance officer must review before a filing, or what the product will not decide. This index has recorded competitors at both ends of that range, one publishing automatic alert closure at scale and another publishing an explicit graduated autonomy ramp, and this record can be placed at neither. The grade reflects absent disclosure rather than a permissive position, and the question is worth putting directly to the vendor.

Products launched, performance unmeasured in public. The financial crime pair went to market in April 2025 and across two passes no detection rate, false positive rate, alert reduction figure, accuracy measure, validation methodology, sample or observation period was located for either. The single customer voice published is qualitative, describing the sophistication and volume of fraud attempts reaching unprecedented levels rather than what the product did about them.

That absence lands on institutions that cannot absorb it easily, since a community bank deploying a vendor model into anti money laundering monitoring owes its examiner documented validation and ongoing performance monitoring, and has neither the staff to build that documentation itself nor, given the partner supplied engine, direct access to the party that could. The company's own core platform claims are by contrast independently measured, which shows the organisation is capable of publishing verifiable evidence when it chooses to.

Third party attributed market position of a kind few vendors in this index can produce, and thin evidence for the artificial intelligence line specifically. The market position is measured rather than claimed: an independent banking industry data source ranks the core platform second most used in the United States, an industry awards programme named it best core banking system, and a research firm assessed it as providing the best user experience among United States core banking systems.

Momentum is reported in units rather than adjectives, with 22 new core wins in one year and a record 33 in the next. Sixty years of continuous operation and a 1.6 billion dollar take private valuation establish the scale of the business.

Against that, the artificial intelligence products launched only in April 2025 and carry one named customer, a community bank quoted through its president and chief executive, with no quantified detection, false positive or workload figure of any kind, and no customer count for the products. Much of the strongest independent evidence dates from 2022 and 2023.

A named accountable executive and no published practice behind him. The company's chief risk and information security officer speaks publicly and on the record about the financial crime products, which is more accountability than a press office quote and means a buyer knows whose name sits against the claims. Managed cybersecurity is a substantial business line rather than a footnote, so security capability is real and commercially proven at scale.

On the artificial intelligence products specifically, the published material is positioning rather than practice: the detection product is described as built for each institution's unique compliance needs and as integrating without disrupting the customer experience, both of which describe fit rather than safety.

Across two passes no model card, evaluation methodology, red team result, incident disclosure or acceptable use boundary was located for the detection or fraud products, and nothing states what account holder transaction data passes to the third party engine behind them or under what terms.

Privacy compliance is sold as a service and not documented as a posture. The company delivers regulatory compliance solutions covering anti money laundering monitoring, real time sanctions screening and know your customer obligations, plus cybersecurity reviews, and positions itself as a compliance partner for institutions facing changing federal regulation. That is capability provided to customers rather than disclosure about the vendor.

Across two passes no privacy programme description, data processing terms, retention schedule or subprocessor list was located, and the Gramm Leach Bliley Act appears nowhere despite the company running core deposit systems for a very large number of the institutions that statute governs.

The gap widens through the estate rather than narrowing: document distribution handles account holder statements, the outsourced call centre puts vendor staff in direct contact with a bank's customers, and the financial crime products pass transaction data to a named third party engine, none of which is described in privacy terms publicly.

The second core provider in this index found selling security while publishing nothing verifiable about its own, and here the contrast is sharper because security is a named business line rather than a supporting function. The company delivers managed cybersecurity and cybersecurity compliance commercially, offers cybersecurity reviews to client banks, appears on managed service provider industry rankings, and employs a chief risk and information security officer who represents it publicly.

Across two passes no trust centre, named certification, attestation report, penetration test summary or subprocessor list was located for the company itself. The controls certainly exist, since a provider running core deposit systems for a very large number of supervised institutions is examined continually by those institutions and their regulators, and a 1.6 billion dollar private equity transaction involved technical diligence. None of it is establishable from outside, and the institutions least able to compel disclosure in procurement are precisely the community banks this company serves.

An unregulated technology supplier whose products are built to named obligations its customers carry. The compliance estate addresses anti money laundering monitoring, real time sanctions screening and know your customer requirements directly, and the company positions itself as helping institutions navigate changing federal regulation, which is specific rather than generic.

Participation in the national instant payment service, extended to all core customers, is operational standing conferred by the operator of that rail. The company also carries a history of public reporting obligations, having traded until November 2022, though those ceased at the take private.

What is absent across two passes is any account of its own standing: no supervisory examination outcome as a bank service provider, no published position on model risk expectations that institutions deploying its detection products must satisfy to their own examiners, and no statement on emerging artificial intelligence regulation.

Determinations about account holders, made on a partner's model, with nothing published about fairness. The detection product monitors transactions and surfaces suspicious activity for institutions that must then decide whether to file a report about a named customer who is never told and cannot respond, and financial crime alerting is well documented as falling unevenly across geography, name origin and transliteration.

The exposure is compounded by the supply structure: because the engine belongs to a third party, a community bank sits two removes from the model judging its customers and has correspondingly less ability to interrogate its behaviour, while retaining the full regulatory obligation for the outcome.

Across two passes no fairness testing, differential performance analysis, model card, bias statement or explainability documentation was located for either the detection or the fraud product, and nothing describes what governance the company applies to a partner supplied model before shipping it to supervised institutions.

No commercial instrument is published. Across two passes no terms of service, master agreement, warranty, indemnity, liability cap, service level or uptime commitment was located, and nothing states what an institution is owed when any part of the estate fails. Two exposures are particular to this record.

The first is concentration: an institution taking the core, digital banking, payments, compliance, managed cybersecurity, managed technology and its call centre from one supplier has placed most of its operating capability with a single counterparty, and the consequences of failure compound across all of it rather than remaining contained to one product.

The second is the supply chain behind the compliance products, where an institution seeking recourse for a missed detection faces a chain rather than a counterparty, since the engine belongs to a named third party and nothing published describes how responsibility divides between the platform and that partner.

The engine behind the artificial intelligence products is named openly, which is the disclosure this axis exists to reward. The anti money laundering and fraud detection pair is stated to be powered by a named data company, that partner supplies its own media contact in the joint announcement, and the company states an intention to develop further fraud solutions with it, so a buyer knows precisely whose models judge their account holders and can assess that party directly rather than inheriting a dependency.

This is the second core provider serving community institutions in this index to name its financial crime engine rather than build one, and the pattern is worth noticing: the segment appears to buy this capability rather than develop it, which concentrates a great many small banks onto a small number of underlying engines they did not choose and may not know about. Two limits keep this out of the top band: no model family, version or technique is named, and the check fraud and conversational capabilities carry no supply disclosure at all.

A core provider making a deliberate choice to work outside its own core. The detection product is stated to integrate into any core banking system while being natively integrated within the company's own, which is the opposite of the usual incumbent instinct to make adjacent products a reason to adopt the core, and it means an institution running a competitor's core can still buy the compliance capability.

Open banking adoption and deepening interface integrations are cited as strategic priorities and as reasons banks chose the platform. Instant payment capability was extended to all core customers rather than sold selectively. The acquired deposit business brought a connector giving third party providers a single interface over disparate core systems, which extends the same philosophy.

The estate also integrates operationally rather than only technically, with an outsourced call centre wired directly into a bank's own customer relationship system. Holding it below the top band: across two passes no public developer documentation, sandbox or named connector catalogue was located.

Cloud delivery emphasised, placement undescribed. The core platform is presented as a fully integrated cloud core banking system combining processing with stable infrastructure, and enhancing public cloud services was named as a company priority around the take private, so the direction of travel is clear.

What is absent across two passes is any statement of hosting provider, available regions, tenancy arrangement, data residency commitment or whether an institution can elect where its records rest. The question is not marginal for this buyer set.

These are supervised depository institutions whose examiners ask where core deposit records are processed and stored, and many of them lack the internal capacity to establish it independently, so published clarity would be worth more to them than to a large bank able to demand it in procurement. The financial crime products add a second unaddressed flow, since transaction data reaches a named third party engine and nothing describes where that processing occurs.

No price, unit or tier is published for the core platform, the compliance products or anything else in the estate, and two passes across the company's site, its newsroom, its product pages and the trade press produced nothing. The published entry route is a contact request.

One structural change removed what disclosure existed: the company traded publicly until November 2022 and filed accordingly, so segment revenue, customer economics and management commentary were once available to a prospective buyer, and since the take private that window has closed. What remains visible is deal flow rather than pricing, since new core wins continue to be announced in counts.

The breadth of the estate makes the silence more consequential than at a single product vendor, because core processing, digital banking, payments, compliance, managed cybersecurity, managed technology, call centre outsourcing and document distribution are eight different commercial shapes, and nothing indicates how they bundle or whether the compliance products can be bought alone.

Deep coverage of one tier of the market, established by an independent ranking rather than asserted. Community and regional banks are the stated focus and the second most used core position in the United States means the institutional footprint is genuinely large across exactly the institutions that most vendors in this index reach only through a marketing page.

The offering is shaped for that buyer specifically: an outsourced call centre, managed information technology and managed cybersecurity exist because a community bank cannot staff those functions, and instant payment capability was made available to all core customers rather than sold as an upgrade, which matters for institutions that would otherwise be left off a national rail.

Corporate customers are served alongside financial institutions, and the company describes both domestic and foreign customers. Two gaps hold it below the top band: no credit union material was located, which is a whole segment a direct competitor dominates, and no total customer count is published for any segment.