Sybrin

The Clearwater precedent applies cleanly. Sybrin is a long established platform business whose payments hub, clearing house systems, low code platform, digital banking suite, case management and document management would all remain entirely intact if the models were removed, so the remainder is very large.

It is built rather than rejected because the models sit inside the regulated operation rather than around it: liveness detection gates whether a remote account opening completes, document inspection determines which files are treated as authentic, and screening and fraud scoring decide which cases reach a human investigator. Those are regulated determinations, not efficiency features. This is the same position as mycomplianceoffice and clearwater rather than the position of the pure proofing specialists in the same competitor set, which grade at the top of this axis.

A human adjudication surface exists and it is shipped as a named product rather than described as a principle. The case management offering is presented as a single workspace in which know your customer, know your business, screening and transaction fraud cases are investigated and resolved, managing data relationships, documents and processes together so that staff can work a case and record a decision.

Onboarding journeys and approval workflows are configurable by the institution without code, which means the customer rather than the vendor sets where automation stops. Against that, the document fraud capability is marketed on dramatically reducing the need for manual review, and nothing published states a confidence threshold, an escalation rule, a sampling rate for reviewing automated approvals, or any route by which a rejected applicant can have a decision reconsidered.

Independent external measurement is present and, unusually, the methodology is published rather than only the conclusion. The evaluation by an accredited biometric laboratory was conducted against the FIDO biometric certification requirements version one point one and in accordance with two parts of the international presentation attack detection standard, and the company discloses the test design in detail: twelve subjects, six level A and four level B attack recipes, one hundred and twenty distinct presentation attack instruments, each attempted five times, producing six hundred attacks conducted in outdoor conditions.

Publishing the test construction lets a reviewer judge the strength of the evidence rather than accept a badge. It is held at the middle grade because no error rates are published in either direction, no model documentation or validation summary exists, no drift monitoring is described, there is no stated position on supporting a customer's own validation, and the evaluation dates from 2021 with no published re test even though the company describes its models as continuously evolving.

Evidence comes principally from independent assessment rather than customer testimony, which is the better type, but the customer layer underneath it is unusually thin for a company of this age. On the independent side there is an accredited laboratory evaluation with a published report, inclusion as a representative vendor in two analyst market guides, a collaboration with a major global foundation on supervisory tooling, and a documented historical first in implementing cheque truncation on the continent.

On the customer side, deployments are described by category rather than by name, no institution is identified in the located material, and no quantified customer outcome such as a fraud reduction, an approval rate change or an onboarding time saving was published. A single named bank with a figure attached would move this to the top grade.

The safety half is independently validated and technically specific. Liveness was tested by an accredited laboratory against level A and level B attacks using instruments including paper masks, reconstructed faces on busts, video replay and live persons, and the company describes a micromovement detection technique aimed specifically at deepfakes, with results returned in under half a second from a single selfie.

Active, passive and combined modes are offered so an institution can match assurance to risk. The stewardship half is unaddressed rather than mishandled: nothing public states whether captured selfies, liveness video or documents are used to train or improve the models, whether an institution can decline that use, how long biometric material is retained, or how data is separated between the many institutions sharing a platform that also runs national payment infrastructure.

Nothing substantive is published on privacy for a vendor whose products capture selfies, liveness video, identity documents and payment transaction data across multiple jurisdictions. No privacy management certification is held, no retention or deletion terms are published for biometric material, and no position is stated on the South African data protection statute governing its home market, on the various African and South East Asian regimes covering its deployments, or on service provider obligations under United States financial privacy law.

The company publishes its broad based economic empowerment contributor status, which shows it discloses regulatory standing where it considers it commercially relevant, so the absence on privacy reads as a choice about emphasis rather than an inability to document compliance.

No information security management certification, service organisation control attestation, trust centre, certifications page or published security scope statement was located, which is a conspicuous gap for a company of this age running national payment infrastructure and processing biometric material for banks and insurers.

The credential the company does promote heavily is the accredited biometric laboratory evaluation, and that is a product performance assessment rather than a security attestation, so it should not be read across. This is the same distinction recorded against Incode, whose attack detection certifications likewise sit on the performance side. Where peers in this same competitor set publish certificate numbers, accreditation chains and subprocessor lists, this vendor publishes none of it.

Sybrin holds no financial licence, but its regulatory proximity is greater than a typical supplier because of what it operates. National clearing house systems are procured and run in conjunction with central banks and national payment authorities, which is infrastructure sitting inside the regulated payment system rather than beside it, and the company positions distinct regulatory technology, supervisory technology and governance offerings.

It is developing a real time fraud risk monitoring capability aimed at supervisors in collaboration with a major global foundation, and contributes to an open source real time fraud management initiative aimed at financial inclusion markets. Product material is written directly against customer identification, know your customer, know your business and anti money laundering obligations.

It stops short of the top grade because no financial regulator has supervised or tested the model layer itself, which is the standard set by CleverChain, and because no specific authorisation or named regulator engagement is published.

This is the only vendor in the identity proofing cohort where an accredited laboratory explicitly tested the product for demographic bias and the result was reported publicly. The evaluation by a laboratory accredited under both the FIDO Alliance and the United States national laboratory accreditation programme covered gender bias and racial bias across Asian, African and European ethnicities, and the reported outcome was that the software development kit identified spoofs without exhibiting race or gender bias across those groups.

That is materially stronger than peers whose fairness position rests on submitting to a general accuracy evaluation that happens to measure differentials, and stronger still than those making ambiguous claims about whose algorithms were assessed.

It falls short of the top grade on four specific points: no per demographic error rates are published, only a pass statement, the sample was twelve subjects across three broad ethnic groupings which is small and coarse, the evaluation dates from 2021 with no published re test against current models, and it assessed presentation attack detection rather than face matching accuracy, which is where demographic disparity most commonly appears.

Nothing published addresses the position of the person a decision falls on. There is no accuracy guarantee, no remediation commitment, no described appeal route for an applicant whose liveness check or document inspection fails, and no allocation of responsibility between the vendor supplying the determination and the institution acting on it.

The case management workspace is the nearest thing to a review mechanism and it is built for the institution's investigators rather than as a route the affected person can invoke. The exposure is broader than for a component supplier because the same vendor also operates payment infrastructure, so a fraud determination can affect access to funds as well as access to an account.

The company describes its approach as a combined use of image processing techniques and neural networks and refers to a continuously evolving platform incorporating the latest machine learning models, but no base model, provider, version or externally sourced component is named for liveness detection, document inspection, character recognition or fraud scoring.

There is no statement that nothing is externally sourced, no subprocessor list, and no model or version identifier an institution could record against a decision. The reference to continuously evolving models without any versioning disclosure is the sharper half of the gap, because it means a bank cannot establish which model produced a determination it may later need to defend.

Sybrin does not integrate with core financial infrastructure so much as constitute it in its markets. The payments hub consolidates high care, mass and real time payment rails on one platform and presents an interface that is agnostic across channel, customer and payment type, explicitly insulating the institution from settlement and regulatory scheme changes.

National clearing house systems are deployed across multiple African countries, which is central market infrastructure rather than a bank side application, and the company implemented the first cheque truncation system on the continent. A low code application platform lets institutions extend into their own processes without vendor development, and the onboarding stack is documented as embedding into account opening and straight through processing. Thirty five years of operation in these markets means the integration surface is proven rather than asserted. Modular, componentised and interface centric architecture is stated throughout.

Delivery appears to run across web based platforms, mobile and web software development kits and a low code environment, and the componentised architecture implies flexibility in how modules are hosted. Beyond that inference the public record is silent. No statement distinguishes hosted service from on premises licensing, no hosting regions are enumerated, no in country residency option is described, no data transfer mechanism is set out and no subprocessor list exists.

The omission is material rather than cosmetic here because the vendor operates in African and South East Asian markets where several jurisdictions impose data localisation requirements on financial and biometric data, and because it runs national clearing infrastructure where hosting arrangements are a supervisory question.

No rates, tiers, volume bands, minimum commitments, licensing structure or trial terms were located for any product in the range. The portfolio spans components normally priced very differently from one another, with a payments hub and clearing house systems typically licensed as major infrastructure programmes while verification modules are usually priced per check, and nothing public indicates which model applies to which product. Every route resolves to a contact or consultation request, so a buyer cannot size any part of a deployment without entering a sales process.

Coverage is genuine, long established and regionally deep rather than global. Deployments span banks, insurers and telecommunications operators across Africa, the Middle East and South East Asia, with national clearing house systems in multiple African countries, and stated implementations at a large South African insurer, a pan African bank and a large bank in the Philippines.

Inclusion as a representative vendor in two analyst market guides covering know your customer platforms for banking and payments technology confirms the segment positioning is recognised externally. It sits below the top grade because the institutions cited are described by type rather than named, no deployment at a global systemically important bank was located, and coverage outside the emerging markets that form its core is thin.