Pegasystems

A forty year old rules, process and case management platform with models layered onto it, and the vendor's own product page settles the question without argument: rules driven processes drive know your customer and due diligence by country, booking entity and product.

Strip every model and the case engine, the rules engine, the orchestration across front and back office, the omnichannel interfaces and the robotic automation all continue, because that is what the company sold for decades before generative capability existed.

Independent technical description of the architecture puts the platform in the role of workflow controller and decisioning engine invoking decision rules for classification, risk scoring and routing, with models and bots as executors beneath it. The agentic capability added in 2025 is real and specific, which is why this is a build at C rather than a rejection, and it is the newest layer on a deterministic spine.

The scoping is deliberate and well stated, and the enforcement mechanism is not described. Agents in the 2025 compliance release are positioned as giving analysts instant, context aware regulatory guidance to support confident decision making, which places the model in an advisory role with the analyst deciding, and the company describes those agents as predictable and reliable rather than autonomous.

Audit trails, case history and accountability for changes are consistent themes, and the platform's case structure means every step is recorded by construction. The company has also stated since 2018 that banks must have control and transparency when using models in onboarding or face regulatory risk.

Held at B rather than A because control and transparency are asserted as properties without the mechanism being named: nothing states what constrains an agent at runtime, what confidence threshold routes a case to a person, or what the default review band is, which is precisely what lifted Appian to an A on this roster.

No validation methodology, accuracy figure, error rate, versioning policy or drift monitoring is published for any capability, including the generative document processing and the screening models. One thing deserves recording because it is unusually candid and still does not carry the axis: in launching its first embedded models the company stated plainly that powerful technologies like artificial intelligence can make decisions that are not always explainable to regulators, naming the weakness of its own technology class in a product announcement.

Identifying the problem is not the same as publishing evidence that this implementation solves it, and the claim of complete control and transparency that follows is an assertion rather than a measurement.

A named global bank and a quantified product claim that are never joined. ING is named for achieving a global know your customer solution on the client lifecycle platform, presented at the company's own conference. Separately the company reports onboarding seventy percent faster and costs sixty percent lower, but those figures are stated as product outcomes rather than attributed to ING or any other institution. Two named executives speak on the record, both the company's own.

Independent recognition is present but thinner than several peers on this roster, resting on an industry award for client lifecycle management rather than analyst quadrant placements. Held at B on the bar applied consistently across this roster: a customer is named, and no figure is attached to that name.

Nothing states whether customer data trains the vendor's models. The question has real force here because the compliance applications process onboarding files, beneficial ownership structures, screening hits and biometric verification across many competing global banks, and because periodic review is driven by continuously screened third party information, so the platform holds both the institution's data and external data about its clients.

No exclusion from any training corpus, no separation commitment between institutions and no statement of controls around the generative components are published. Against the reference set of Mortgage Capital Trading, Needl and AlphaSense the silence is a choice.

No privacy posture of the vendor's own is published. GDPR appears only as one of several regimes the application is positioned to help a bank satisfy, alongside eIDAS, anti money laundering rules, FATF, FATCA and the common reporting standard, which is a product capability claim rather than a commitment about how the supplier handles data.

Nothing addresses retention of the identity documents, video identification recordings and biometric templates the verification capability necessarily creates, purge on termination, or the treatment of screening results about individuals who are not the customer.

No security certification is enumerated in the material reviewed. No SOC report of either type, no ISO 27001, no penetration testing statement and no trust portal was located. Queued check where the expected answer is strongly at odds with the grade, exactly as recorded for Appian: this company sells to global banks and to government, and processes identity documents, biometric templates and screening results, so attestations and government authorisation programmes are very likely to exist. Nothing was seen, so nothing is asserted in either direction.

A software supplier with no financial services licence, authorisation or supervisory relationship of its own. Being listed on a United States exchange is corporate and securities regulation rather than financial services standing and does not read across under the standing bar. All regulatory language in the product material describes obligations the application helps an institution meet, which is a product claim. No registration, enrolment or supervised programme participation was found.

No fairness testing, protected characteristic handling, model inventory or named governance framework is published. One adjacent engagement is worth recording because it is nearly unique on this roster: the company frames its embedded recommendation capability against regulations designed to prevent predatory sales practices, which require banks to ensure every product offer is suitable for the customer receiving it.

Suitability is the closest thing to a fairness obligation that appears anywhere in this quadrant, and the company engages with it as a compliance constraint the software helps manage rather than as a position about how its own models distribute offers.

The unaddressed exposure is concrete: facial recognition and biometric verification are deployed for account opening with no demographic performance breakdown and no false reject rate by cohort, the same gap recorded across the identity proofing tier.

No recourse position is published. Nothing states who carries the consequence when biometric verification wrongly rejects an applicant, when screening produces a false match, when generative document processing misreads an onboarding file, or when an agent gives an analyst wrong regulatory guidance that is then acted on.

The last of these is a distinctive exposure created by the advisory design itself: when a model advises and a person decides, responsibility for a bad outcome is divided between the supplier that produced the guidance and the analyst who followed it, and nothing addresses that division. The individual wrongly matched or rejected has no relationship with the vendor at all.

No model, family, version or provider is named for any capability, including the generative document processing, the screening models, the workflow generation tool and the compliance agents. One third party dependency is named and it is instructive that it is the wrong kind: Moody's is identified as the source of entity data and entity verification, which is a data supply chain disclosure rather than a model one.

The distinction matters and parallels one recorded against Opensee, where the cloud provider was named repeatedly and the model never was. Naming the data source is not naming the model, and vendors should not receive credit on this axis for the former.

Integration is named and architectural rather than asserted. The client lifecycle product integrates Moody's entity data and entity verification capability, a specific third party dependency identified by name. Identity verification incorporates facial recognition, video identification and biometrics.

The platform orchestrates end to end from front office through back office on unified rules, process and case management, and reaches legacy systems through robotic automation where application programming interfaces are unavailable, which is the integration problem most acute in older banks. Omnichannel reach is enumerated across mobile application, live chat, web self service, co-browsing, telephone and in person. Screening of third party information is continuous enough to trigger client reviews automatically when data changes, which requires live connections rather than periodic extracts.

No deployment or residency position was found in the material reviewed. Nothing located states which delivery models are supported, which regions are available, or where client data is processed and stored. The omission carries weight for this product line specifically, because due diligence is applied by booking entity and jurisdiction, which means the software is explicitly handling the question of which national rules apply to a client relationship while saying nothing about which national rules apply to the data about it. Queued rather than treated as settled, since an enterprise vendor of this scale commonly documents deployment options outside the pages reviewed here.

No pricing information was located in the material reviewed. No licence basis, no per case or per user metering, no tier structure and no indicative implementation cost for the compliance applications. Queued check with a specific warning attached, learned from Appian on this same roster: aggregator sources for enterprise low code pricing proved wildly unreliable there, returning five different answers across five sites including one stating no pricing was published at all. Any check on this vendor must go to its own material or a marketplace listing, and nothing found so far qualifies.

Deep across institution type and geography. The client lifecycle applications explicitly handle institutional, advisor, fund and correspondent bank onboarding as distinct shapes, which is a harder coverage claim than serving one segment well, and due diligence is applied differentially by country, booking entity and product across global jurisdictions.

The company operates across North America, Europe, Latin America and Asia Pacific and counts global banks among its client base, with ING named for a global deployment. Independent recognition includes a best client lifecycle management solution award at an industry banking technology programme.

The compliance line is positioned at the largest institutions, where the company cites external research that banks devote up to fifteen percent of full time staff to know your customer and anti money laundering work.