Nasdaq Verafin

Detection is upstream of everything else the platform does, and detection is model carried. Strip the models and the case management, investigation and regulatory filing layers still exist but have nothing arriving in them, which is the extraction led refinement of the residue test rather than the workflow platform version. The agentic workforce pushes it further: the models now do the analyst's triage work as well as the detection, and the company sells that as role replacement rather than as assistance.

A described and unusual control: institutions configure the level of automation and the level of human review separately for each workflow, set against their own risk appetite. That is a real mechanism positioned in the path, and it is an honest design for a supervised function, since the institution rather than the vendor owns the risk appetite the regulator will examine.

Held off A because the dial is described with no defaults, no floor and no thresholds, and because of what sits under it: alert auto dispositioning is the highest consequence automation in this pocket, as a wrongly closed alert is a suspicious activity report that never gets filed.

The governance shape worth naming is that the vendor devolves the oversight decision to the supervised party, which is defensible and also means the published answer to how much review happens is that it depends on the customer.

No model documentation, no accuracy or detection rate figures, no validation approach and no drift policy, for models that decide which customers are investigated and reported. The specific gap is the one this index has learned to ask about: the product is sold on reduced false positive volume with no baseline, no rate and no statement of what happened to the true positives.

Auto dispositioning is exactly where a true positive gets closed quietly, and a suppressed alert leaves no trace in the same way a false positive does, so the metric the vendor promotes is the one that cannot reveal the failure that matters.

Adoption evidence for the generative products specifically, which is uncommon: more than 650 financial institutions using the agentic products within months of launch, alongside a consortium of roughly 2,800 institutions. A named executive is on the record. Scale figures come through the listed parent's investor channel, which carries exposure a marketing claim does not.

Held at B because no named institution is attached to a measured result, and the efficiency claims are directional rather than quantified. Banked check: this vendor maintains a customer stories library that was not opened in this pass, and that library has moved evidence grades repeatedly in this sweep.

The most disclosed instance of pooled data in this index, and the reason it earns a B rather than the usual C is that the pooling is stated, quantified and central rather than hinted at: a cross institutional network of roughly 2,800 institutions, named as the source of the models' typology awareness, with agentic workers described as drawing on consortium insight while they work.

Held off A, and the reason is the useful part: disclosing the FACT of pooling is not disclosing the TERMS of it. Nothing published covers what an institution's data may be used for, whether contribution is a condition of use, whether an institution can opt out of contributing while still consuming, or what happens to contributed data on exit.

The privacy footing of the consortium is the central question for this vendor rather than a peripheral one, and it was not located in this pass. Banked check, and it is the highest value one on this record: whether the consortium operates under the United States information sharing provision that permits financial institutions to share data with each other for money laundering and terrorist financing purposes. If it does, this is a rare case of pooled data resting on an explicit statutory basis rather than on contract terms nobody publishes, and it would move both this row and the stewardship row.

No certification or trust portal located in this pass, and an unverified credential earns nothing even where one is near certain. Banked check, cheap and likely to move the grade: a cloud platform holding transaction data for thousands of supervised institutions, owned by a listed exchange operator, will hold service organisation control reporting at minimum. Look for a dedicated trust or compliance page under the parent as well as the product domain.

No licence or supervised status credited. Banked check that would be the second instance of a correction already made once in this index: whether a cloud provider hosting and processing transaction data on behalf of banks and credit unions falls inside examination authority for bank service providers.

The standing rule from that earlier correction is that the authority attaches to PERFORMING the service rather than to licensing software a bank runs itself, and this vendor is on the performing side of that line, which makes it the strongest open candidate in the index for that route.

No fairness testing, no protected class analysis, no governance disclosure. The exposure is among the sharpest in the index and is rarely framed this way: anti money laundering triage decides which customers get investigated and reported to the authorities, and fraud analysis decides whose transactions are held.

Both are consequential judgements about named individuals and businesses, and the underlying models learn typologies from a pooled corpus whose composition is not described, so any skew in what the consortium has historically reported propagates into what the agents flag next.

No recourse route and no allocation of responsibility. The structural point is that liability sits with the supervised party by design: an alert closed automatically that should have been escalated becomes the institution's compliance failure and the institution's regulatory exposure, not the vendor's. That is the same pattern seen elsewhere in this index where a credentialed professional or a licensed firm signs for machine generated work. The customer facing consequence is untouched either way, since a person reported or blocked has no visibility of the model, the consortium or the disposition.

An agentic workforce with advanced reasoning capabilities, and no model, provider, architecture or version named anywhere. The consortium data behind the models is described in detail while the models themselves are not described at all, which is a consistent asymmetry in this index: vendors will happily quantify the data asset they own and stay silent about the model they license.

Data ingestion from core banking systems at 2,800 institutions is real depth. The novel part is the platform agnostic deployment, and it deserves recording as an integration pattern in its own right: rather than building an interface into a competitor's product, the vendor sends an agent to sign in and operate that product's alert queue the way an employee would. That is agent as integration strategy, and it is what a vendor does when it cannot get an interface into a rival system. Held off A because no named core banking or case management connector appears in the material, so the depth rests on scale and on the overlay approach rather than on named counterparties.

Cloud delivery is the historic differentiator here against on premise incumbents, and the new overlay model adds a second deployment shape where the agent runs against a third party system. Neither is accompanied by any published statement on region, residency or tenancy, which matters for a vendor pooling transaction data from institutions in more than one country.

No price, tier or unit published. Enterprise sold through direct engagement, standard for the pocket and for a listed parent that reports this line inside a segment rather than by product.

Deep rather than wide, and deliberately so. Banks and credit unions, with a consortium spanning roughly 2,800 institutions, covering anti money laundering, fraud, sanctions, high risk customer management, investigation and regulatory reporting across the whole anti financial crime function. Held off A because the institution types are narrow by design, with no insurer, capital markets, asset management or payments buyer addressed, and the footprint is predominantly North American.