GBG

Identity data, address verification and credit bureau access, the deterministic matching GBG was founded on in 1989, would still carry much of the business without any model. Its inference layer is material all the same: machine learning in transaction monitoring and application fraud, synthetic media detection in document checks, and the Reach and GoPlane agents of its 2026 portfolio.

GoPlane, in beta, runs each decision as a real GBG Go journey tied to a retrievable run identifier and returns accept, refer or reject, sending a refer to a human reviewer with the full evidence trail. Reach, generally available, adds policy based accept, review or reject recommendations, and the AI charter commits that people direct and control its systems.

Determinism is built into Reach, which returns the same score for the same input, with a confidence score from 0 to 1 per signal and Auditable Verification Codes that explain each result. Validation method, model documentation and supervisory mapping are unpublished, and continuously learning detection models carry no drift governance.

Cetelem in Mexico, part of BNP Paribas Personal Finance, cut losses 50 percent between 2019 and 2020 after adopting GBG Instinct, a result attributed to more automation and higher investigator productivity. That figure is several years old, and newer claims such as up to 51 percent fewer false positive alerts are ceilings tied to no customer.

Fraud networks pool data from several hundred organizations across more than twenty sectors, held by GBG as controller for up to ten years, and the trust score is returned without divulging protected data to other members. It is a disclosure boundary, not a training one: whether contributions train the shared models, or can be withheld, goes unstated.

The products privacy policy, updated July 1, 2026, separates GBG's processor role for customers from its controller role for fraud networks and publishes a retention table, 12 months for audit trails and zero to 31 days for most product data. Subsidiaries such as Acuant and IDology are named, but no subprocessor list is.

A SafeBase trust center lists ISO/IEC 27001:2022, SOC 2 Type 1 and Type 2 reports by product line, and FedRAMP Moderate among other credentials, with sensitive documents behind access approval. Because coverage varies by product line, the report for a given product matters more than the list.

GB Group PLC sits on the UK government's statutory register of digital verification services, with trust marks 020401 to 020405 for five services certified on September 14, 2026 and valid to September 27, 2029. The register covers identity checking in the United Kingdom rather than financial regulation, and Identify and GBG Go also carry right to work and right to rent codes.

Avoiding unfair bias is one of seven AI charter principles implemented at board level, but no fairness evaluation, method or framework is published. Document and biometric verification is where demographic error gaps in identity technology have been documented, varying by document type, issuing country and skin tone.

People checked through its services can seek access, correction, erasure and objection through a webform, but GBG publishes no commitment behind a check's output. A person wrongly failed at onboarding sees neither the trust score nor that a consortium fed it, and nothing says who answers when an agent acts on a wrong GBG result.

Detection models for the trust score, transaction monitoring and document checks have no named model, provider or version. Anthropic is the one named provider, its Claude Haiku powering an optional address parsing tool in Reach on the customer's own key.

One interface, GBG Go, delivers identity, document and business checks with public developer documentation and reaches multiple credit bureaus through one integration. Agent products add a web API, an MCP server and a Claude Agent Skill callable from tools such as Cursor and ChatGPT, yet none of a bank's own systems of record is named as a target.

Regional sites serve the United Kingdom, the United States and Asia Pacific, and data moves among subsidiaries and partners on several continents under standard contractual clauses, but no hosting provider, region or residency commitment is named. With identity records from more than eighty countries in the fraud networks, a buyer is left unsure where its own customers' records sit.

Reach draws on existing Loqate account credits and GoPlane on an existing GBG Go key, yet neither lists a per call price, and the core products route to a demo request. What a single check costs is still unclear.

Seven segments each get a page of their own, from financial services and lending to gaming and government. Coverage spans 195 countries for document and biometric checks and 50 for data verification, from onboarding through investigations.