Lucinity

The removal test leaves a case management tool. The company is built around its generative assistant, launched in 2023 as the first copilot for financial crime prevention, which renders complex data into real time insights, analyses cases, runs adverse media checks and drafts regulatory reports, turning work measured in hours into work measured in minutes. The stated purpose of the whole platform is combining models with human expertise, and the newer positioning around agent led operations pushes further in the same direction rather than away from it.

Human involvement is the company's entire identity, expressed in a Human AI positioning that combines models with human expertise, delivered as a copilot supporting investigators rather than a system deciding for them, and underpinned by detailed audit logging described as ensuring maximum auditability because the product was built inside the compliance sector. A published ethical artificial intelligence pledge sits alongside it.

One shift deserves noting and is not addressed anywhere: the same product described in 2024 as your artificial intelligence copilot is described in 2026 as your artificial intelligence agent, with the partner integration framed around agent driven investigation workflows, and no corresponding statement explains what changed in the oversight model when the language changed.

The architecture is named rather than asserted, with the assistant described as combining retrieval augmented generation with rigorous validation to deliver safe and accurate output, and the company has published specifically on how that combination works. Retrieval grounding is the correct control for this use case because it ties statements to case documents rather than to model recall.

Detailed audit logging means any conclusion can be reconstructed afterwards, which matters where findings support regulatory filings and potentially legal proceedings. What is missing is measurement: no accuracy rate, false positive figure, summarisation fidelity result or validation output is published, so a model risk function has an architecture to assess and no numbers to assess it against.

The strongest single fact is recent and structural: in April 2026 a major enterprise software group secured rights to this company's investigation and case management technology and embedded it into its own financial crime and compliance platform, making agent led investigation workflows available to financial institutions across that group's global customer base. That is a large incumbent choosing to distribute a startup's technology rather than build its own.

Named customers include a payments business owned by a global card network, whose money laundering reporting officer is quoted directly, and a national bank. Financial Times reporting recorded seven large global banks requesting trials of the standalone copilot, with the chief executive stating usage among those customers had grown exponentially. The company won partner of the year for its country at a major cloud provider's 2024 partner awards.

Two architectural facts answer most of this axis. The assistant runs on an enterprise cloud AI service chosen explicitly for data protection rather than on a consumer grade interface, which is the arrangement under which customer prompts and documents are not used to improve the provider's models.

And retrieval augmented generation means the system retrieves from an institution's own case material at query time rather than absorbing it into weights, so what one bank's investigations contain does not become part of a model serving another. Held at B because the retention terms behind that arrangement are not stated in the way Marloo states its own, and nothing addresses whether anything is learned across the customer base.

The privacy position is tied to a specific infrastructure choice and stated as the reason for it: the assistant was developed on a major provider's enterprise AI service in order to guarantee security standards and offer what the company describes as top tier protection for clients' sensitive data while meeting regulatory and enterprise requirements.

That matters because the payload is customer transaction histories, investigation case files and the personal circumstances of people suspected of financial crime, which is among the most sensitive material a bank holds. Held at B because no retention schedule, subprocessor list or data processing terms were located.

Security is asserted through the infrastructure choice, with the enterprise cloud AI service described as providing secure infrastructure and the highest standards, and no attestation, certification, trust centre or enumerated framework was located.

Trials at seven large global banks and an embedding arrangement with a major enterprise software group mean vendor security assessment has been passed at demanding standards repeatedly, and none of that assurance is published for a prospective buyer to read.

No regulator, statute or instrument is named. The product is deeply regulatory in function, generating and submitting suspicious activity reports with stated consistency, completeness and quality, and its buyer is typically the money laundering reporting officer, so the regime is implicit throughout.

What is absent is any citation: no supervisory body, reporting rule or programme requirement appears, and for a platform whose output becomes a regulatory filing, naming the regime that governs those filings would be the obvious disclosure.

A published ethical artificial intelligence pledge is more than most vendors offer and it is a commitment document rather than a mechanism. Three exposures sit beneath it. Adverse media checking carries the documented false positive problem on common names and non Western naming conventions. A suspicious activity report is an accusation that follows a person, and a system that drafts them faster produces more of them.

And the least examined risk is summarisation itself: the assistant condenses complex case material for the investigator who decides, so what the summary omits is what the decision omits, and an investigator working from a generated summary cannot know what was left out. No error analysis, population level testing or summarisation fidelity measure was located.

No commercial guarantee or indemnity was located, and accountability is nonetheless reconstructable by design. Detailed audit logging captures what the assistant did within an investigation, which matters more here than in most applications because the output feeds regulatory filings that may later be examined by supervisors or tested in proceedings, so an institution can show how a conclusion was reached and where a model contributed.

What is missing is the subject side entirely: a person named in a report has no knowledge of it by law and therefore no route to challenge an automated contribution to it, which is inherent to the regime rather than a vendor failing, and the vendor offers nothing beyond it.

The model provider is named explicitly and repeatedly, with the enterprise cloud artificial intelligence service identified as the foundation of the assistant and the choice justified on security and responsible development grounds rather than mentioned in passing. That is more than most vendors in this index disclose, and it lets a buyer assess the fourth party exposure directly. Retrieval augmented generation is named as the technique.

What is not disclosed is the rest of the chain: no subprocessor list appears, no data source is identified for adverse media or sanctions content, and no hosting arrangement is described beyond the cloud platform itself.

Integration is the strategy rather than a feature. The platform is explicitly system agnostic, stated to connect with any transaction monitoring, fraud or know your customer system an institution currently runs or wishes to add, and the assistant is additionally available as a plugin that works inside an existing enterprise ecosystem, described as transforming siloed systems in seconds and providing value without replacing anything.

Distribution extends further through embedding into a major enterprise financial crime platform and through availability on a leading cloud marketplace. That combination, plugin, platform embedding and marketplace, reaches institutions three separate ways.

The underlying cloud platform is named explicitly and repeatedly, which is more disclosure than most vendors provide, and it stops short of a residency position. No region selection, data location commitment or private deployment option is published, which matters for a company with corporate entities in three jurisdictions serving banks across Europe and North America, each with its own expectations about where customer investigation data is processed.

No pricing, packaging or basis of charge was located. One procurement route is published and it is more useful than it first appears: presence on a major cloud marketplace means an institution can draw on existing cloud commitments to pay for the platform, which shortens the purchasing cycle inside large banks considerably. The company has also published on the build versus buy question its buyers face. Neither amounts to a rate, and nothing indicates whether charge falls per seat, per case, per institution or on usage.

Buyers span retail and wholesale banks, payment institutions and fintechs, with corporate entities established in Iceland, the United Kingdom and the United States and reach extending globally through the enterprise platform partnership.

Functional coverage is broad within financial crime, running from transaction monitoring investigation and case management through customer view, adverse media, fraud and know your customer work to regulatory report generation and submission, with configurable workflow automation on top. The limit is domain: this is financial crime operations specifically, and it addresses the investigation and reporting layer rather than detection itself.