Kore.ai

Kore.ai has been a conversational AI company since its first product, and the agent platform is what it sells. The thing being bought is the capability to design, deploy, govern and optimize agents. AI for Banking is a prebuilt set of banking agents rather than a workflow product with models attached, and there is no prior non model product underneath that would survive. It was built around the assistant from the start, unlike conversation platforms that added models to an existing communications spine.

Every agent action is stated to carry an immutable audit trail, which lets an institution reconstruct exactly what an agent did. Observability tooling surfaces agent performance, exception trends and risk indicators. Developers can extend guardrails without disrupting the surrounding systems, and agents are described as escalating exceptions when human judgment is required. An audit trail is a reconstruction capability after the fact rather than a control in the execution path.

What triggers an escalation is not described, no confidence threshold or approval checkpoint is named, and the guardrails are configurable by the customer rather than specified by the vendor. The strength of the control depends on the buyer rather than the product.

Governance is delivered as platform capability. Every agent action has an immutable audit trail, and observability covers agent performance and exception trends. Risk indicators are surfaced to the operator, and tenant isolation separates one institution's agents from another's. An institution's model risk function could review what happened.

What it could not review is how well the agents work, because no accuracy figure, containment rate or escalation rate is published, and neither is any error rate or validation summary. One absence stands out: ISO 42001. Kore.ai has federal security authorization, PCI DSS certification, a SOC report and ISO 27001, and no AI specific certification at all.

The gap between this vendor's scale and what it publishes about financial services outcomes is the single most conspicuous thing about its disclosure. Named customers with quantified results exist but sit outside banking operations. A European banking group describes taking human resources automation from a single region chatbot in 2020 to a multi jurisdiction strategy by 2025, and a pharmaceutical company reports a technology service desk handling 70 percent of requests.

The financial services customer stories are anonymized as a global bank and a major bank. One quantified banking figure appears without an institution attached, an executive describing 15 to 20 minutes returned to each financial adviser daily. Analyst evaluation is referenced for two conversational AI categories without a stated placement, which is weaker than naming one. A vendor of this size publishing anonymous banking case studies is making a choice.

Tenant isolation is stated as a platform property, which answers the cross customer question architecturally, and real time tokenization limits what sensitive content reaches the model layer at all. On premises and sovereign deployment give an institution the strongest available form of the same assurance. Two gaps remain. Nothing states whether customer interactions inform model or product improvement, which is the question tenant isolation does not answer.

And the vendor operates an agent marketplace offering prebuilt agents, templates and integrations. That introduces components an institution did not build into conversations with its own customers, and nothing is published about what those components may access.

Real time tokenization of personally identifying information is applied to every agent action, which is privacy by construction rather than privacy by policy. Tenant isolation and on premises and sovereign deployment options add to it, as do stated European data protection compliance and health information privacy alignment. An institution that needs conversation data never to leave its own estate has a supported path to that. The public material stops at the assertions.

No data processing agreement, subprocessor list or retention schedule is available outside the gated trust center, and nothing describes what conversation content is retained, or for how long, once tokenization has run.

The security credential stack is deep. Kore.ai has a SOC 2 Type II report, ISO 27001 and PCI DSS certification, and a FedRAMP Moderate authorization. It also states alignment with health information privacy rules, the health information trust framework and European data protection law. A live trust center operates at its own subdomain on a continuously monitored platform and is described as covering security practices, compliance programs and governance.

The federal authorization stands out: it is a government run assessment against a defined control baseline. Selling into government and healthcare alongside banking forces a bar that financial services only vendors never encounter, and the disclosure reflects it.

Kore.ai is a technology supplier and has no financial license, which is the correct posture. Its standing rests on formal admission rather than a stated position. A FedRAMP Moderate authorization is a government operated assessment with a defined baseline and a sponsoring agency, and PCI DSS certification is a second formal scheme. Neither is a supervised regulator test of the AI product itself. No financial supervisor has tested the banking agents.

The agents make consumer facing decisions, and no fairness testing, differential outcome monitoring or impact assessment is published. Loan servicing, fraud resolution and card blocking carry material consequences, so the exposure is concrete rather than theoretical. A fraud resolution agent that treats some customers' disputes differently from others produces exactly the kind of uneven outcome that bias disclosure exists to surface.

Multi channel operation including interactive voice response adds an accessibility dimension, since voice recognition performance varies by accent, speech pattern and assistive technology use, and nothing addresses per channel or per population performance.

A wrong answer from these agents lands directly on a consumer who has no relationship with the vendor. The agents operate at the point where a customer is told whether a disputed transaction will be reversed, whether a card can be replaced or what a loan account currently requires. No error rate, remediation commitment, liability position or correction path is published.

The marketplace adds a further open question: when a prebuilt or partner supplied agent gives a bank's customer wrong information, nothing states where responsibility sits between the component's author, the platform distributing it and the institution whose name appears on the conversation.

Where inference happens is disclosed; which models perform it is not. The banking application is stated to run on Azure AI Foundry, but no model provider, family or version is named for the agents the vendor itself supplies. The platform is positioned as model agnostic, with developers able to integrate advanced models of their own choosing. Deployment options including on premises give an institution a route to control the question itself, which is a different thing from the vendor answering it.

More than 300 integrations reach core banking systems, payment platforms, customer relationship management, policy administration, risk engines and data warehouses, and more than 40 voice and digital channels carry the conversation itself.

The distribution position adds to it materially: the banking application is packaged and sold through Microsoft's marketplace and runs on Azure AI Foundry alongside Dynamics 365 Contact Center, Teams and Copilot, so an institution already standardised on that stack adopts it without a separate integration programme.

Named enterprise connections extend beyond financial services to Salesforce, HubSpot, Jira and GitHub, which matters because agents operating in a bank touch internal engineering and service tooling as well as the core.

Four deployment models are offered rather than one: public cloud, sovereign regions, private cloud and on premises, with data residency stated by region. A bank in a jurisdiction with localization requirements, a government client and a commercial customer wanting managed cloud can each be served without the vendor changing product. On premises is the option that lets an institution keep member and customer conversation data entirely inside its own estate. Tenant isolation is stated separately as a platform property.

Getting a number takes a call with a sales team. No pricing, tier structure, billing basis or indicative range is published on the vendor's own material. The banking application is listed on a third party cloud marketplace, a channel where transactable pricing is conventional and would offer a simple route to disclosure, and no published rate appears there either.

Banking coverage spans retail, commercial and wealth management rather than one line, and the use cases named run across the institution, from account support, card block and replacement and fraud resolution to loan servicing and internal employee support. Both banks and credit unions are served, and the footprint is global rather than domestic, with a named European banking group among the referenced deployments. Employee facing and customer facing workflows are both covered.