Prometeia

A firm whose entire business is models, of which the learned ones are a growing minority. The flagship suite computes asset and liability management, interest rate risk in the banking book, liquidity, balance sheet simulation and regulatory capital, and those are econometric and actuarial constructions rather than machine learning: strip every AI component and the platform that two hundred institutions license still runs, because that platform is quantitative finance rather than inference.

What sits beside it is genuine and unusually substantial for a legacy firm, including a model build and validation environment, a published validation framework for AI models, a generative model assessment tool and a purpose trained vertical language model. Graded on where the product's weight sits, which is still the quantitative libraries.

A gate is described and positioned, which is more than most on this roster manage. Models are built, validated and deployed within a stated governance framework, validation is placed explicitly before production rather than after, and the firm's own published argument is that pre deployment validation is how trust in AI models is established.

The generative model assessment tool produces a compliance assessment for a human validator and offers a chatbot for interrogating specific aspects rather than issuing a verdict. Held at B because no thresholds, escalation criteria or limits on unaided action are published, and the oversight described is a methodology the buyer operates rather than an enforcement mechanism the vendor guarantees.

The most substantive published model risk material on this roster and the reason it does not reach an A is the sharpest example of a pattern the index has now recorded three times. What is published is real: a validation framework for AI based models organised around data, methodology, process and governance and mapped explicitly to conceptual soundness, model performance and model usage, which is the supervisory vocabulary rather than a marketing paraphrase; a build and validation environment that lets the institution customise the firm's quantitative libraries or write its own in Python; a generative tool that assesses a bank's credit risk models against regulatory and internal guidance; and published work citing the European banking supervisor's machine learning guidance for internal ratings based models.

Every bit of it governs the customer's models. Nothing documents the firm's own: no evaluation of the vertical language model, no accuracy measurement for the model assessment tool, no versioning and no drift disclosure. A vendor that sells AI model validation as a product publishes no validation of its own AI models.

Independent recognition without a single identified client. A specialist risk industry publication named the asset and liability management suite its system of the year, and the firm appears repeatedly in an annual global wealth technology selection, both of which are genuine external evaluations. Against that sit only self reported counts: over four hundred customers, more than two hundred on the risk platform, twenty countries, a thousand professionals.

No institution is named anywhere in the material reviewed, no outcome is attributed to a customer, and the executives quoted are the firm's own. This is the fifth vendor of comparable scale in this roster to publish no checkable customer evidence.

Closer to an answer than most and still not one. The vertical language model is described as trained on a combination of external and synthetic financial data, which is a statement about what the corpus contains rather than a claim about model quality, and synthetic data generation is offered as a product in its own right, so the technique for avoiding real client records is plainly available to the firm and understood by it.

What is missing is the general position: no policy states whether client risk, portfolio or document data is used to train or improve models across the customer base, no retention or exclusion terms are published, and one model's corpus described in trade coverage is not a stewardship commitment.

No published position on retention, deletion, subprocessors or cross border transfer, despite a delivery footprint spanning the European Union, the United Kingdom, Switzerland, Turkey and Egypt, which crosses several distinct data protection regimes and at least one adequacy boundary. The consulting model compounds the question, since advisory engagements place the firm's staff inside client data environments.

No certification, attestation or security documentation surfaced in the material reviewed, for a firm processing risk, balance sheet and client portfolio data for four hundred financial institutions and public bodies. Worth recording as a small irony rather than a deduction: the certification that does surface in the firm's published material is an environmental building standard for its headquarters.

Genuine licensed standing inside the group, narrower in scope than the strongest examples in this index. Prometeia Advisor SIM is an authorised Italian investment firm, a designation that cannot be used without authorisation and that carries supervision, conduct obligations and the possibility of sanction, and it delivers the group's financial advisory line.

Held at B rather than A because the authorisation covers the advisory entity rather than the software business that this record is mainly about, and because it is one authorisation against the two plus licensed national infrastructure that earned an A elsewhere in this pocket. The basis is the firm's own description of the entity; the supervisory register entry was not checked directly.

No fairness or bias material was found, which is a notable absence given that the firm publishes more governance methodology than almost anyone else on this roster. Its validation framework names governance as one of four pillars, so the material where fairness testing, protected characteristic treatment or disparate impact measurement would sit demonstrably exists in some form, and none of it appears in what is published. Queued check: the framework paper itself is the place to look before this grade is treated as settled.

No published position. The exposure is institutional rather than consumer facing for most of the estate, since the subjects are balance sheets, portfolios and model inventories rather than individuals, so recourse largely collapses into commercial terms between sophisticated parties. The one place it does not is the advisory and private banking line, where model driven recommendations reach end clients through the institution, and nothing addresses responsibility there either.

More provenance than most and still no name. The vertical language model is disclosed as built on open source frameworks and trained on external and synthetic financial data, which tells a buyer the class of foundation and the character of the corpus, and the firm states that it goes beyond simply integrating large language models. But no model, family, version or provider is identified for that system or for the generative assessment tool, and no statement covers which third party models, if any, process client documentation.

Better evidenced than most here because one third party dependency is named rather than gestured at: the risk suite integrates a named external analytics and pricing library to value fixed income, foreign exchange and interest rate derivatives in real time, adopted explicitly for its documentation and calculation transparency.

The model environment is open to the buyer's own code in Python, the suite is listed on a major cloud marketplace, and the language model is deployable inside the institution. Held at B because no core banking, general ledger or data warehouse platform is named as a supported integration.

Partial and incidental rather than stated. The vertical language model is described as deployable on the institution's own premises, which is a meaningful option for a bank that cannot send financial documents outside its perimeter, and the risk suite appears on a public cloud marketplace.

But no deployment model is documented for the platform generally, no hosting arrangement, region or residency commitment is published, and what exists is inferred from two product specific facts rather than from any published position.

Nothing published across software, consulting or research. No licence fees, module pricing, day rates or subscription terms, and no indication of how the blend of platform and advisory is charged, which is the question a buyer would actually have given the firm sells both into the same engagement.

More than four hundred customers across twenty countries, with the risk platform alone reported at over two hundred institutions, and a buyer set spanning banks, insurers, institutional investors, corporates and public institutions.

Functional coverage inside those buyers is wide, reaching the chief risk officer, chief financial officer, treasury, wealth management and private banking functions through separate lines, and the firm sells consulting, software and economic research into the same relationships. Offices run from Italy across London, Frankfurt, Zurich, Vienna, Istanbul and Cairo, including a representative presence positioned deliberately alongside the European supervisory and monetary authorities.