Vyntra

A rules and machine learning engine with behavioral profiling and prebuilt models for scams, fraud and insider threats drives the financial crime platform, while the observability half of the merged company runs on configurable statistical models with AI still on its roadmap. Rules based monitoring, case management and observability would remain without the models.

The platform is read only, sits outside the payment flow and never modifies, blocks or cancels a payment itself, leaving every action to the bank's systems. Alerts route to one case manager with a shared audit trail, though the thresholds at which a bank's systems hold an instant payment are unpublished.

Every score, from fraud alerts to sanctions matches, comes with its drivers, and observability thresholds are described as easier to configure, explain and validate than opaque models. Detection and false positive rates, a validation method and any supervisory model risk mapping are not published.

First year figures claim 11.1 billion transactions monitored, 70,500 frauds prevented and an estimated $735 million in losses avoided, across more than 130 institutions including four of the top ten European banks. Zürcher Kantonalbank and Banque Cantonale de Fribourg are quoted as community scoring members, but no bank is joined to a figure.

Models and data sit in each institution's own instance, and cross institution learning happens only through opt in community scoring, exchanging entities, indicators and risk signals as weighted features within a trusted circle. What a shared signal may contain, such as a flagged counterparty's account identifier, and how long the hub keeps it are not described.

Raw data is encrypted under a two key scheme with the outer key in the customer's key store, and community scoring shares no raw customer data between members. No privacy notice, retention terms for community signals or hub subprocessor list is published.

ISO 27001 certification is in progress rather than held, and no attestation or trust center is published. Running on the customer's infrastructure shifts much of the security surface to the bank.

Scoring explainable to a regulator and operational resilience obligations are mentioned, but no regulator, statute or rule is named. For a supplier to Swiss cantonal banks, FINMA expectations or the EU instant payments rules would be the natural reference.

Customers with irregular patterns, uncommon corridors or cross border activity draw more alerts than predictable domestic customers, and community signals can carry a flag beyond the bank that raised it. Alert rates across customer groups are not published, and score drivers explain an alert without evaluating fairness.

Automated customer callbacks contact the person behind a flagged payment instead of leaving it silently held. Neither a guarantee nor an indemnity is published, and correction of a wrongly flagged pattern across the community hub goes unexplained.

Its models are its own, and external inputs are named by type: payment scheme indicators and MISP type threat feeds through a hub whose members include SWITCH's computer emergency response team. Sanctions watchlist sources and any hub subprocessor are not named.

Named connections run from SWIFT messages and ISO 20022 to SEPA in Europe and FedNow in the United States, over MQ, Kafka and REST interfaces. A core banking platform is not named, and API documentation is not public.

Deployment is always on infrastructure the customer manages, on premises, in its own AWS, Azure or Google Cloud environment, or hybrid, with no SaaS option. Institutions decide where data is physically stored and can isolate deployments by entity or jurisdiction.

Subscription pricing follows average daily message or transaction volume over a rolling 28 day period and concurrent users, on three to five year terms, with implementation charged as a one time fee. Rates themselves are quoted on request.

Banks, private banks, cantonal and state owned banks and wealth managers in more than 60 countries are served, with use case pages from instant payments and authorized push payment scams to sanctions screening. Material is organized by use case rather than institution type.