Jack Henry

A core processing company with a broad artificial intelligence programme layered across it. Management reported 22 artificial intelligence enabled products in market with more than 20 further capabilities identified for release within six months, which is a wider spread than most competitors here can claim, but the phrasing is the point: these are capabilities added to products rather than products that exist because of them.

Strip the models and the company remains substantially intact, since the credit union and community bank cores, the digital banking platform serving more than 15.8 million registered users, the payments modules and the treasury estate are all deterministic systems of record that predate the models by decades. The financial crimes platform is the most model dependent product, and even there the analytics engine is a partner's rather than the company's own.

The security work with a cloud provider applies agentic defence to protect the estate rather than to sell intelligence. The company's own framing in its annual report places artificial intelligence within a technology strategy that also covers cloud rollout, serving both internal ways of working and product offerings.

Consistently assistive by design, stated as a commitment, with one item that needs the usual scrutiny. The pattern across the products is a person deciding: the digital banking assistant supplies suggested responses for staff and hands off between employee and automation rather than replacing the conversation, the fraud platform detects and alerts with investigators dispositioning, and management commits publicly that clients always remain in control.

Real time interdiction exists, since the platform can stop a transaction before it leaves the institution, but under rules the institution sets. The item to examine is assisted drafting of suspicious activity report narratives. That document is what a regulator and potentially a court reads, written about a person who will never see it and cannot contest it, and the framing here is better than at several competitors because the stated benefit is giving the investigator back an hour to investigate further rather than removing the investigator. Nothing published states what the investigator must review or attest before a drafted narrative becomes a filing, which is the question this capability always raises.

The best outcome disclosure in this sweep on one side of the ledger, and silence on the side that would make it interpretable. The published figure is unusually well constructed: alert rates below one percent, representing roughly an 80 percent reduction in alerts reaching institutions, stated with the mechanism and the population rather than as a bare percentage, alongside at least an hour saved per investigation on narrative drafting. What is missing is the counterpart.

An 80 percent reduction in alerts carries no accompanying figure for how much genuine fraud detection was retained, and a reduction of that size is trivially achievable by detecting less, which is precisely the criticism this index has already recorded against another vendor in this lane. The reference to meaningful alerts gestures at retention without quantifying it.

Also absent across two passes: validation methodology, false negative rate, sample and observation period, drift or retraining disclosure, and any model documentation an institution could put in front of its own examiners, which is complicated further by the engine belonging to a partner.

Evidence reported quarterly under securities law, which makes adoption claims auditable rather than assertable, and outcome figures that carry a mechanism. Adoption for the artificial intelligence products is stated with specificity and movement: 189 completed financial crimes platform installations as at 30 June 2026 with 57 more in progress, 183 new contracts across that platform and the faster payment modules over the year with 61 in the fourth quarter, 191 faster payment modules installed with 231 in progress, and digital platform signings of 219 for the year, up 24 percent, reaching more than 15.8 million registered users, up 11 percent.

Outcome evidence is quantified and explained rather than asserted: alert rates below one percent representing roughly an 80 percent reduction in alerts reaching institutions, and assisted drafting of regulatory report narratives saving at least an hour per investigation. Customers are named with named executives, including a federal savings bank and a community bank president. Independent recognition includes an analyst assessment naming the small business digital platform the leading one in its category and an industry award for the fraud platform.

A governance commitment made where it carries consequences, and two design choices that support it. Management stated on the record in a quarterly earnings call that across all 22 artificial intelligence enabled products and the further capabilities in development, strict risk management, compliance and governance frameworks would be maintained so that clients always remain in control.

A statement to investors on a call carries securities exposure that a marketing page does not, which makes it the most accountable governance commitment located in this sweep. The design choices reinforce it. Adopting the Federal Reserve's published fraud classification model natively means classifications follow a public regulator authored taxonomy rather than a proprietary scheme, which makes outcomes comparable across institutions and harder to quietly redefine.

And the cloud collaboration applies agentic capability to defence, using artificial intelligence to protect the estate rather than only to expose new surface. Absent across two passes: model card, evaluation methodology, red team result, incident disclosure and any statement on what accountholder data trains or contextualises the models.

Regulatory compliance is sold as a product and not much is published about the company's own posture. The financial crimes platform is built around obligations its customers carry, screening against sanctions and watchlists, filing suspicious activity and currency transaction reports and validating Bank Secrecy Act and anti money laundering compliance, so the company demonstrably understands the regime its clients operate under.

That is compliance delivered to customers rather than privacy practised by the vendor, and the two should not be read as the same thing. Across two passes no privacy programme description, data processing disclosure, retention schedule or subprocessor list was located, and the Gramm Leach Bliley Act appears nowhere on the surfaces examined despite the company processing deposit accounts for roughly 7,400 institutions governed by it.

The gap has an added dimension here because the fraud analytics run on a named third party engine and the security platform on a named cloud provider, so accountholder transaction data reaches parties beyond the vendor without any published description of what moves or under what terms.

A disclosure gap made conspicuous by what the company sells. Across two passes no trust centre, named certification, attestation report, penetration test summary or subprocessor list was located on the public surface. The controls exist beyond reasonable doubt, since a processor running deposit systems for roughly 7,400 supervised institutions is examined continually by those institutions and their regulators, and the company is a listed registrant with internal control obligations.

What makes the silence stand out is the positioning: this company is currently building a proprietary artificial intelligence security platform to sell to its clients, explicitly designed around the strict compliance, regulatory and security requirements of community institutions, while publishing nothing verifiable about its own security credentials. A vendor asking institutions to trust it with their cyber defence has a stronger than usual reason to publish what it holds. The practical effect falls hardest on the smallest clients, who lack the procurement leverage to demand documents a larger bank would simply require.

No licence of its own, and the most concrete regulatory engagement among the core providers in this index. The financial crimes platform is built directly to named United States obligations rather than described as helping with compliance generally, covering Bank Secrecy Act validation, suspicious activity and currency transaction report filing, and sanctions and watchlist screening.

More distinctive is the native adoption of the Federal Reserve's published fraud classification model, which means the vendor has taken a regulator authored taxonomy as its own classification scheme rather than inventing one, a choice that makes an institution's reporting legible to its examiners without translation.

The security platform is explicitly positioned against the compliance, regulatory and security requirements of community institutions, a segment supervised by multiple federal agencies. As a listed registrant the company carries quarterly and annual reporting obligations and makes governance commitments on the record. Absent: any published account of its own examinations as a bank service provider, and any position under the European artificial intelligence regulation, though its footprint is essentially domestic.

The determinations here reach individuals and nothing published addresses whether they land evenly. The fraud platform monitors accountholder transactions, flags suspicious activity, screens against watchlists and now drafts the narrative that becomes a regulatory filing about a named person who is never told and cannot respond.

Financial crime alerting has well documented uneven effects across geography, name origin and transliteration, and the added exposure here is structural: the analytics engine belongs to a third party, so a community bank sits two removes from the model that judges its members and has correspondingly less ability to interrogate it.

Adoption of the regulator's published classification taxonomy is a genuine partial mitigation, because it standardises what a fraud type means across institutions and makes patterns comparable, but a shared vocabulary for classifying outcomes says nothing about whether the outcomes are distributed fairly. Across two passes no fairness testing, differential performance analysis, model card or bias statement was located for any of the 22 artificial intelligence enabled products.

No commercial instrument is published. Across two passes no terms of service, master agreement, warranty, indemnity, liability cap or published service level was located, and nothing states what an institution is owed when an artificial intelligence product is wrong. Three exposures sit uncovered and they are not equivalent. The platform can stop a transaction before it leaves the institution, so a wrongly held payment is a direct customer harm.

Assisted drafting produces the narrative of a regulatory filing, so a defective draft that survives review becomes the institution's problem with its examiner rather than the vendor's. And because the analytics engine belongs to a named third party, an institution seeking recourse for a detection failure faces a chain rather than a counterparty, with nothing published describing how responsibility is divided between the platform and the engine behind it. Management's commitment that clients always remain in control is a governance posture, and it arguably places responsibility with the institution rather than allocating it contractually.

This vendor names the suppliers that actually matter, which is rare enough to be the strongest feature of the record. The financial crimes platform is stated to be built through a partnership with a named specialist fraud analytics company, with both parties publishing joint material about the collaboration and its results, so a buyer knows precisely whose models judge their accountholders.

The security platform is built on a named cloud provider's agentic defence products under a relationship dating to 2022, and operational capabilities run on that provider's enterprise agent platform. Naming both the analytics engine and the cloud artificial intelligence provider lets an institution assess those parties directly rather than inheriting undisclosed dependencies.

One consequence follows that a buyer should see and that only disclosure makes visible: the named analytics partner is itself an independent vendor in this market and appears elsewhere in this index, so an institution running both that vendor directly and this platform may be paying twice for one model estate and carrying more concentrated exposure to a single engine than it realises. No model family or version is named.

This vendor is the core for roughly 7,400 institutions, and it has made a structural choice that works against its own gatekeeping position. The integration network launched in July 2025 gives third party applications direct access to technical resources and open interfaces, explicitly removing the financial institution from the middle of the integration process, which is the opposite of the usual incumbent behaviour of routing every connection through the core provider and charging for the privilege.

The digital toolkit provides a public interface surface for the banking platform, and the company reports an open ecosystem of more than a thousand third party providers. The financial crimes platform connects across the company's own digital and payments estate and outward to third party systems including a major person to person network and custom institution systems. Payments reach spans the instant schemes with adoption reported by scheme.

For a community institution with no engineering capacity, being able to reach a fintech without the core provider standing in the way is the single most consequential integration property available, and this company publishes it as policy.

Cloud native and fully hosted, with the placement questions unaddressed. The financial crimes platform is described as fully hosted and built on public cloud, which the company presents as enabling real time data, more accurate reporting, open integrations and speed, and the wider technology strategy is stated to include a rollout of cloud solutions. A named cloud provider relationship dating to 2022 underpins the security platform and operational artificial intelligence work.

What is absent across two passes is anything a regulated buyer would need to close the question: no region list, no residency commitment, no tenancy description, and no statement of what remains on institution controlled infrastructure versus what moves to the vendor or onward to its partners. That last point carries weight for this particular buyer set.

Community banks and credit unions with average assets around 1.2 to 1.3 billion dollars have limited leverage in vendor negotiations and limited internal capacity to interrogate a hosting arrangement, so published clarity would matter more to them than to a large institution able to demand it.

No price, unit or tier is published for the core, the digital platform, the financial crimes product or any of the artificial intelligence capabilities, and two passes produced nothing across the company's site, its investor materials and the trade press. What the securities filings supply instead is a structural picture of the commercial model that a buyer can genuinely use.

Because the company reports contract signings and installations separately for the financial crimes platform and the faster payment modules, distinct from core client counts, it is evident that these are modular products contracted individually rather than bundled into a core agreement, which tells a prospective buyer that adopting one does not require adopting everything and that each carries its own commercial negotiation.

Segment revenue, client counts and growth rates are published quarterly with management commentary, so the size and health of the business unit selling to them is visible. None of that is a price, and nothing indicates whether the artificial intelligence capabilities carry incremental charges or arrive within existing licences.

The deepest coverage of the small institution tier in this index, and the only vendor here that defines that tier precisely rather than gesturing at it. Roughly 7,400 community banks and credit unions are served, and the annual report states the average core bank client at 1.29 billion dollars in assets and the average core credit union client at 1.20 billion, which tells a prospective buyer exactly which end of the market this company is built for.

Credit unions are a segment most vendors in this index do not address at all, and here the credit union core is the dominant platform in its category rather than a secondary line. Coverage runs across the estate those institutions actually need, spanning core processing, digital banking for retail and small business, payments including the instant schemes with adoption reported by scheme, lending, treasury management, financial crime and Bank Secrecy Act compliance. What is absent is scale in the other direction, since nothing here addresses large national or global institutions, and the geographic footprint is essentially domestic.