Hawk

Machine learning is the product and the company positions itself explicitly against the rules-only systems it displaces, arguing those produce false positives requiring human review and are increasingly circumvented by criminals who learn the rules. Explainable models run as an overlay alongside deterministic rules, and an investigative agent applies agentic AI to casework including automated drafting of regulatory report narratives. The chief executive's framing is that artificial intelligence is in the company's DNA, and the architecture supports it.

The division of labour is sensible and stated: the agent performs data collection, case categorisation and drafting of the regulatory narrative, while the filing decision and the investigation judgement remain with the compliance officer, and explainability exists specifically so a human can interrogate why an alert fired. The overlay design also means the deterministic rule layer continues to operate underneath. Held at B because no approval requirement, escalation threshold or review step is published for agent-drafted narratives that become regulatory filings.

Explainability is the stated core of the design rather than a feature, and the company is explicit about why, addressing the black-box problem directly on the grounds that understanding why an algorithm reached a decision is essential and institutions must be able to justify why a customer was flagged. The hybrid architecture helps, since the rule layer remains deterministic and inspectable underneath the learned overlay, and accuracy is published against a baseline. Held at B because the headline accuracy figure is hedged as applying in some cases, and no validation methodology, false positive rate or model monitoring approach is disclosed.

More than 80 customers globally are claimed and eight are named across very different institution types, including a major German universal bank running the platform to supplement its existing rule-based compliance systems, a pan-African banking group, a telecommunications operator, two payments businesses, an international bank, and two digital-first fintechs.

Performance is quantified rather than gestured at, with alert accuracy reported approaching 90 percent in some deployments alongside significant false positive reduction and twice as many previously undetected cases of novel criminal activity. Three independent analyst recognitions support it, including strong performer standing in a major anti-money laundering evaluation and a ranked place in a financial crime technology index with a named innovation award won twice consecutively.

No boundary statement was located. A financial crime platform observing transaction patterns across 80 institutions on four continents holds a view of criminal typologies no single bank could assemble, and detecting novel criminal activity is precisely a claim about learning across that base. Nothing states whether models improve from customer transaction data, whether learning is pooled or isolated, or what an institution contributes by joining.

No data protection agreement, retention schedule or subprocessor list was located. The platform ingests full transaction flows and customer records across more than 80 institutions and screens individuals against politically exposed person, sanctions and adverse media sources, which involves extensive processing of data about people who are not the customer, and none of the handling terms are published.

No attestation, certification, trust centre or enumerated control set was located. Tier one banks and an international banking group have completed supplier assessment before routing live transaction data through the platform, so assurance exists privately, and nothing is published for an institution beginning its own review.

The regulatory frame is named at regime and mechanism level across jurisdictions, covering the United States bank secrecy statute, international financial action task force recommendations and the European sixth anti-money laundering directive, with product functions mapped to specific obligations: sanctions and watchlist screening including politically exposed persons and adverse media, customer due diligence automated at onboarding and maintained through the lifecycle as perpetual screening, and suspicious activity reporting. The company states plainly that the platform provides transparency and auditability for regulatory requirements, which is the property examiners test.

No fairness testing, disparity analysis or bias monitoring was located, and the exposure is real and well documented in this category specifically. Financial crime screening produces disproportionate flagging of customers with particular names, nationalities and remittance patterns, and the consequence of a false positive is not a declined application but account closure or exclusion from banking altogether. Explainability tells the institution why an alert fired; it does not establish whether the model fires more often for some populations than others.

No guarantee, indemnity or correction process was located, and the affected individual is in an unusually weak position in this category. A customer flagged by screening may be de-banked or have payments blocked without being told why, since tipping-off rules restrict what an institution may disclose about a suspicious activity investigation. Explainability serves the bank's ability to justify the decision to a regulator rather than the customer's ability to contest it, and nothing describes any route to correction.

No base model, provider or hosting arrangement is identified for the learned overlay or the investigative agent. External dependencies are substantial in this category, since sanctions lists, politically exposed person data and adverse media feeds come from commercial providers whose coverage determines what gets caught, and deeper integration with third-party data providers is named as a funding priority without any provider being identified.

All four major United States core banking providers are named as supported through a partner integration, which matters because financial crime monitoring must see the transaction flow at core level rather than at an application layer, and this is only the second vendor in the index to name that full set.

Open interfaces allow connection to any system and any data source, integration with existing core banking and data management systems is stated directly, and further work on third-party data provider connections was a named use of the most recent funding.

Two deployment models are offered explicitly, a hosted service or private cloud, which gives an institution unwilling to route transaction data through a shared environment a supported path, and the platform is described as cloud-native and scalable with multiple deployment options.

Held at B because no regions, residency commitments or hosting providers are named, which matters for a company serving customers across Europe, Africa, Asia and North America under different data localisation regimes.

No pricing, packaging or basis of charge was located. One commercial feature is stated, that multiple solutions sit under a single contract rather than separate agreements per module, which simplifies procurement without indicating cost, and nothing shows whether charge follows transaction volume, customer count or module selection.

The range is unusually wide and evidenced by named customers rather than asserted, spanning tier one banks, an international bank, payment providers, a telecommunications operator and digital-first fintechs, with offices across Europe, North America and Asia and more than 40 percent of revenue from the United States.

Product coverage is equally broad within financial crime, unifying transaction monitoring, payment and customer screening, customer risk rating, entity risk detection and fraud across the customer lifecycle from account takeover to transaction fraud, under one platform.