StandardC

The platform came first and the AI was layered onto it. VerifyC, ApplyC and MonitorC shipped as a compliance workflow suite through 2025, built on GPS tagged photo capture, configurable questionnaires, dynamic workflows, document capture and screening, and StandardC AI launched in May 2026 as what the company itself calls the AI layer powering that platform.

Strip the agents and a working virtual site inspection and onboarding system remains, which is a saleable product and was sold as one. The AI is shipped rather than announced, with a named agent bench, an agent studio for configuration and a report artefact, so this is well clear of the centrality floor applied to 10X Banking, Hypercore and Polly. Peer checked before grading: platform shaped onboarding vendors Baselayer and AiPrise both sit at B, while the agent native KYB vendors Arva AI and Accend hold A, and this sits with the former group.

One of the clearer oversight positions in the index and stated as a design intent rather than a disclaimer. The company's own framing is that the agents were built to partner with people rather than replace them, and the described division of labour matches it: agents perform the initial review of an application, loan or client file according to the institution's own policies and procedures, conduct structured analysis and produce consistent reproducible reports, with the decision remaining with the institution.

Every agent action produces a report the company describes as examiner ready, which is the right artefact for this buyer because a community bank must be able to show an examiner how a conclusion was reached. Short of A because no threshold, escalation route or exception path is published, and nothing describes what happens when an agent's initial review is wrong and a reviewer does not catch it.

No accuracy, evaluation methodology, error rate or validation evidence for any agent. The 20x productivity claim is unmethodologised. Reproducibility is asserted, in that agents are said to produce consistent reproducible reports, and that is a real property but a different one from correctness: an agent can be perfectly reproducible and reproducibly wrong. The regulatory dimension matters here because of who the customers are.

Banks using vendor supplied models are expected to validate them under supervisory model risk guidance, and that expectation does not transfer to the vendor but does mean the vendor must supply enough documentation for the institution to meet it. Nothing published indicates such a package exists.

No named customer and self reported figures only, which is the C bar exactly. Two headline numbers circulate, a 20x productivity gain across onboarding, compliance, due diligence, underwriting and monitoring, and 80 to 90 percent cost savings on VerifyC against in person business and asset verifications, and both are attributed to customers who are not named, with no methodology, baseline or sample behind either.

Worth recording because it is easy to misread: the testimonial quotes on the company's own site are largely from its own people, including the chief experience officer and the chairman, presented in the visual position where customer quotes normally sit. That is not customer evidence.

The cost saving figure is the more interesting of the two because it is structurally plausible, since replacing a physical site visit with a remote one has an obvious cost basis, and one named institution willing to state it would move this axis immediately.

The architecture answers the stewardship question directly rather than through policy, which is the stronger form. The question every institution asks a shared platform is whether its customer records can reach a model that another institution's outputs also draw on, and the stated answer is that customer data never enters a model at all. That also disposes of the training question by construction, since data that never reaches a model cannot be trained on.

Automated audit logging is a named platform feature, giving an institution its own record of what was accessed. What is not addressed is the layer above the model boundary: multiple competing community banks and credit unions use the same platform, and nothing states whether screening results, risk typologies or merchant level intelligence derived from one institution's activity inform anything served to another.

The most specific privacy position of any vendor in this pull, and the only one that names the regime by name. The company engages directly with Gramm Leach Bliley obligations, the Bank Secrecy Act and customer due diligence duties, and names the supervisors its buyers answer to, the Federal Reserve, FDIC, OCC and NCUA with interagency guidance from the FFIEC.

The architectural commitment is unambiguous: customer personally identifiable information never reaches any AI model, described as structural and a precondition of analysis rather than a downstream control that can be misconfigured. The reservation, and it is the same one recorded against IDVerse's zero bias claim, is that an absolute assertion is not a measurement.

Patent pending is a filing status, not an audit, no technical paper describing the mechanism was found, and no independent party has verified the claim. It earns the B for engaging seriously and specifically where most vendors say nothing, not for having proven it.

No SOC 2, ISO 27001, penetration testing cadence or trust centre found in public material. Automated audit logging is offered as a product feature, which is a control for the customer's own compliance rather than an attestation about the vendor's environment.

This is the sharpest inconsistency in the profile: a company whose entire differentiation is that it handles regulated customer data more safely than conventional enterprise AI publishes no independent verification of how it handles that data itself.

Supervised institutions request these reports as a matter of routine in vendor due diligence, so the reports may well exist privately, and as noted for bondIT, passing a review privately is not the same as publishing evidence a buyer can read before the first call.

No licence or regulated status of its own, which is expected, but there is a specific gap worth naming for this buyer set. A technology provider serving supervised depository institutions falls within FFIEC third party risk management expectations, and for a vendor performing onboarding, due diligence and monitoring the institution must be able to evidence its oversight of that vendor.

Nothing published states whether the company has been through a bank examination, appears on any institution's critical vendor list, or provides the due diligence package examiners expect. The company engages with the client side perimeter more explicitly than most, naming the statutes and the four supervisors, which makes the silence about its own position on the other side of that relationship more conspicuous rather than less.

No governance framework, model inventory, review process or fairness testing published. The exposure is concentrated in ApplyC, which covers applications, onboarding and underwriting, putting the product inside equal credit opportunity and fair lending duties whenever an agent's initial review shapes a credit outcome.

There is a second and less obvious exposure in the screening and monitoring modules that this index has now recorded three times, at Fincom, Dossiers and here: name matching and adverse media screening produce uneven error rates across scripts, transliterations and press coverage density, so applicants with names common outside the Latin script alphabet generate more false matches and more friction. Nothing addresses either.

No warranty, service level, accuracy commitment or remedy published. The harmed party has a definite identity here, which is not true of every vendor in this category: a small business applying for a bank account or a loan, whose file receives an automated initial review, and who in the cannabis related and high risk merchant segments this platform specialises in may have few alternative institutions willing to serve them at all.

A wrongly screened or wrongly declined applicant in that position has no visibility that an automated review contributed and no route to contest it, because their relationship is with the bank and the bank's relationship is with the vendor. The examiner ready report makes the decision traceable for the institution and the regulator, which is valuable and is not the same as recourse for the applicant.

No model, provider, version or hosting arrangement named anywhere, and that omission is more consequential here than for almost any other vendor in the index because of what the company sells. The entire proposition is a claim about the relationship between customer data and an AI model, contrasted explicitly with conventional enterprise AI that routes personally identifiable information through the model under access controls.

Evaluating that claim requires knowing which model, run by whom, under what terms, and reached over what path, and none of it is stated. A buyer is being asked to accept an architectural guarantee about a component that is never identified.

The integration story is thin and the gap is specific to this buyer. The positioning is consolidation rather than connection, replacing tasks previously handled across multiple systems with a single unified platform, and deployment is claimed in days. Only one third party integration is named anywhere, ID.me for identity verification within the audit trail.

What is absent is the thing a community bank asks first: no integration is named with any core banking platform, and for a bank or credit union the onboarding and monitoring workflow has to reach the core system where the account actually opens. A platform that consolidates adjacent tools but does not describe how it connects to the system of record leaves the buyer to bridge that gap.

Deployment speed is published, at days for the platform and days for new programs, but speed is not a deployment model. No hosting arrangement, cloud provider, region, tenancy model, single tenant option or data residency commitment appears anywhere.

That omission sits awkwardly beside the central claim, because an architecture that structurally separates customer data from AI models is fundamentally a statement about where data goes, and the vendor describes the boundary between its platform and the model without describing where its own platform runs.

A pay as you grow model is described, with the claim that institutions pay only for what they use, but no unit, rate, band or minimum is published, so the phrase conveys the shape of the contract without letting a buyer estimate anything. This falls short of the disclosure that earned Korint a B, which named the pricing basis plus specific terms on seats and integration fees.

The company positions itself on price as well as capability, arguing that community banks and credit unions deserve technology once reserved for the largest institutions, and that argument would be considerably stronger with a number attached.

Three distinct buyer types named and consistently served: community banks, credit unions and merchant processors, with the company describing itself as extending to other regulated industries. The concentration is deliberate rather than incidental, since the whole positioning is that smaller community focused institutions lack access to the tooling large banks buy.

A notable specialism visible in the product surface is cannabis related business screening and monitoring, which is a genuine niche most compliance vendors avoid and which likely explains the origin of the virtual site inspection product. Coverage is US only with no international regime surface, and no large bank, asset manager or insurer buyer appears.