SS&C Technologies

Clearwater precedent, and the vendor settles it against itself in its own published answer to the question. Asked what separates its AI automation from traditional robotic process automation, it says that automation provides the secure, reliable execution layer while embedded AI capabilities enable automation of more complex, judgment based work. The execution layer is the deterministic robot and the models sit on top of it.

Strip them and a market leading robotic process automation platform remains, which is what this business was for two decades and what the 2025 Gartner leadership position is awarded for. The same holds one level up: SS&C's fund administration, transfer agency and portfolio accounting businesses predate all of it.

Clears the backbase bar: a named enforcement mechanism with its position in the execution path stated. The AI Gateway is described as standing between the AI and the customer's applications, verifying every action that passes through, and is sold as a separate governance product rather than as a feature claim. Its controls are enumerated rather than gestured at: audit trails, business rules, role based access control and real time risk notifications.

Orchestration through Chorus carries human in the loop steps, and the agents ship with accuracy evaluators. Recorded honestly: the word guardrails also appears, which is normally B language, and the grade does not rest on it. It rests on a product whose stated function is to sit in the path and check each action before it reaches a system of record.

Second autonomy A of this roster after Broadridge, and the two are different shapes worth contrasting: Broadridge publishes constraints on what its own agents may do, SS&C sells the checkpoint as infrastructure that governs anyone's agents.

Third clean instance of the hyperexponential precedent, after that vendor and provenir: the company sells model governance as a product and publishes nothing about its own models. The AI Gateway is an enterprise AI governance platform with audit trails, guardrails and business rules, all of it applied over whatever models the customer runs, and the agents ship with accuracy evaluators as a named component.

That is a shipped mechanism rather than a value statement, which is what separates a B from a C on this axis, and it is the same reasoning that gave TCS its bias grade. Held at B and not A because nothing is published about the vendor's own models: no accuracy figures, no evaluator methodology or thresholds, no validation results, no drift monitoring, no versioning. Say it as before: a platform that sells model governance is not thereby transparent about its own models.

The strongest evidence case on this roster and the first to clear A. Quantified outcomes are attached to named institutions rather than floating free: Invesco saving 2.1 million dollars a year, Banorte increasing processing capacity 30 percent, ABANCA responding to inquiries 60 percent faster, Banco Supervielle at full compliance with government regulations, and Spain's Ministry of Justice saving 1.1 million hours. State Street has a dedicated case study on know your customer work.

Independent recognition is current and from two separate houses: Gartner leader for robotic process automation 2025 and Everest Group leader for intelligent process automation platforms. One caution recorded rather than deducted: several of the numbers appear only in a summarised proof points list, so the underlying case studies were not read and the figures are the vendor's own framing of them.

The sharpest form of the learning claim yet seen, and it is the vendor's central proof point rather than an aside. Every agent is stated to be developed, tested and deployed within SS&C's own operations before being released to customers, with more than 3,571 active agents and around 7 billion tokens a month cited as evidence that the agents are proven.

The unexamined step is what SS&C's own operations are: this company administers funds, maintains shareholder registers and runs insurance and healthcare processing on behalf of clients. Agents refined in those operations were refined on work performed on client records. Nothing states what data was involved, whether any of it informs agents later sold to other institutions, or what separation exists.

Fifth and strongest instance of the shape after evalueserve, pennant, broadridge and ION: broadridge refined agents across more than 40 outsourcing clients, and here the proving ground is the vendor's entire client servicing operation.

A standard privacy policy and nothing addressed to the platform or the agents. The gap is material because of what this vendor is: agents operating inside fund administration, transfer agency, claims and know your customer processes handle investor records, policyholder data and identity documents, and nothing published states retention, access by vendor personnel in the managed offerings, or processing commitments distinct from the self hosted product. The security page covers protecting data well and says nothing about what is done with it.

One of the better security disclosures in the index and a strong B. Both credentials are published as downloadable certificate documents rather than badges: a Cyber Essentials certificate dated 2026 and a BSI certificate of registration for ISO 27001 dated 2026, which names the certification body and the year, clearing the provenir verifiable in one click bar with the actual document rather than a verification link.

The development practice is described in named mechanisms: mandatory secure coding education before production access, static application security testing, software composition analysis with dependency scanning against vulnerability databases, monitoring of third party repositories, virtual gateways blocking any branch that fails an automatic scan, and named tooling partners.

Controls are aligned to stated external references including the NIST risk management framework and OWASP and PCI guidance. A live security updates feed is published. Held at B: no SOC 2 or SOC 1 appears anywhere, which is a real gap for a group performing fund administration and transfer agency work whose output reaches audited accounts, and there is no trust portal with a report cadence against the standing reference bar. One precision fault recorded and not deducted twice: the page body writes the standard as ISO270001, a digit wrong, while the certificate behind it is correct.

No licence or supervisory standing claimed in the material reviewed, so nothing is credited. Queued as the highest value open check on this vendor, because the Broadridge precedent is directly applicable and points the other way: Broadridge took an A because the entity operating its trading venue is a registered broker dealer, stated in its own release.

SS&C performs transfer agency and fund administration, which are regulated activities carried out on behalf of institutions rather than software licensed to them, so the settled rule places at least part of this group inside a supervisory perimeter. If a registration is published by the group in its own name, this axis should be reconsidered and could move materially. Nasdaq listing is noted and earns nothing: an issuer obligation is not a licence to conduct a regulated activity.

Governance is the product and none of it is fairness. The published governance vocabulary covers access control, audit, policy enforcement and risk notification, all of it about who may do what and whether it is recorded, and nothing anywhere addresses disparate outcomes.

That matters here more than on most large platforms because the named use cases reach insurance underwriting and claims and financial services compliance monitoring and customer support, all decisions that land on individuals. A vendor selling AI governance to regulated industries with no fairness position is a cleaner statement of the index's central observation than most: governance in this market currently means control of the system, not fairness to the person the system decides about.

Nothing published on who bears an error. Concrete and easy to state given the shipped use cases: a credit agreement processed straight through on a wrong extracted term, a claim decided by an agent, a compliance alert not raised. The audit trail records what happened and answers a different question from who pays.

Recorded alongside the security page as a deliberate contrast, because it makes the point precisely: this vendor is willing to publish a live unresolved vulnerability in its own product, so the silence on liability is not a general reticence about admitting exposure. It is specific to this axis, as it is for every other vendor in this index.

No model, family, provider or version named in vendor specification anywhere, for any agent or for the gateway. One model name does appear on the vendor's site, in a customer quote describing that customer's own build, and it is not creditable as a statement about what the product depends on.

The gateway being model agnostic is architecturally real and is the reason this is a queued check rather than a settled C: the Fioneer route to a B is to publish the architecture of the dependency and hand the choice to the customer, and a governance gateway with private language model chat is close to that shape without being stated as such. The AI Gateway product page was not opened and is the place to resolve it. Nothing else earns anything: Amazon Web Services is named as a cloud, and three security tooling firms are named, all of which are the lower rungs the standing rule excludes.

Two distinct routes to depth, both real. The parent owns books of record in fund administration, transfer agency and portfolio accounting. The automation platform is explicitly built to operate across modern and legacy applications with or without programmable interfaces, which is the defining capability of this product class and the thing it markets against competitors, and it ships a Digital Exchange marketplace of prebuilt connectors.

The Credit Agreement Processing agent is described with downstream system integration for straight through processing rather than as an extraction tool that stops at output, which is the distinction that matters for this axis.

Delivery options are distinct, named and separately documented: a self managed enterprise product installed by the customer, a fully managed cloud service where the vendor hosts, secures and maintains, and managed and professional services around both. Amazon Web Services is named as a cloud partner with its own page, and a Cloud Operations Security team is described with a stated remit for continuous post deployment scanning, which is unusually concrete for this axis. Held off A for the standard reason: no data residency statement, no regional hosting map and no sovereignty commitment, for a platform serving regulated institutions across many jurisdictions.

Held at C and this is a deliberately queued refusal rather than a finding of absence. A plans and pricing page exists and is linked by the vendor from its own reference material, which already puts it ahead of almost every large vendor on this roster, and it was not opened. The axis measures what a buyer can learn about cost and that question is currently unanswered rather than answered negatively. Cheapest available grade move on this vendor: open the pricing page. The First AML precedent is the reason it cannot be assumed favourable, since that vendor published a pricing page carrying three tiers and no prices at all.

Very wide on both halves of the axis. Named financial institutions include State Street, Invesco, Banorte, ABANCA and Banco Supervielle, alongside public sector and corporate users. Financial services, insurance, healthcare, manufacturing, public sector, telecommunications and energy each have separately addressed industry solutions, and the parent group runs fund administration, transfer agency, asset and wealth management software, insurance and healthcare administration in its own right. Within financial services the named use cases are specific rather than generic: fraud detection, compliance monitoring, customer support, claims, underwriting and credit agreement processing.