Fintech
Agentic AI for fintech operations — onboarding, KYC, dunning and revenue operations — engineered to hold up under DORA, PSD2 and EU regulatory scrutiny.
What makes fintech hard for AI
Fintech carries the compliance burden of a bank with the engineering cadence of a startup. That combination is where most AI deployments come apart.
Regulatory obligations arrive faster than platforms
The Digital Operational Resilience Act has applied since January 2025, bringing ICT risk management, incident reporting and third-party oversight into scope — including the AI services you depend on. PSD2 strong customer authentication constrains what can be automated in a payment journey, and the EU AI Act layers classification duties on top.
Explainability is a licence condition, not a preference
A model that declines an application or flags a transaction has to be explainable to a supervisor and to the customer. Post-hoc rationalisation does not survive review; the decision path has to be logged as it happens.
Fraud patterns move faster than retraining cycles
Static models decay quickly against adversarial behaviour. Without continuous evaluation, quality drifts silently and the first signal is a loss event.
Where the value concentrates
The returns cluster in high-volume, rules-heavy processes where a human currently reads the same document types repeatedly.
- Onboarding and KYC. Document extraction, sanctions and PEP screening, and adverse-media review — with escalation only on genuine ambiguity.
- Transaction monitoring triage. Alert enrichment and prioritisation that cuts false-positive review load without weakening coverage.
- Revenue operations. Context-aware dunning, reconciliation and usage-metering validation.
- Regulatory reporting. Assembling evidence continuously rather than in a quarterly scramble.
What the economics look like
Onboarding is usually the clearest case: manual review is expensive, cycle time directly affects conversion, and the decision is well-bounded. Transaction monitoring is the second, because false-positive rates in the high nineties are common and even modest triage improvements free significant analyst capacity.
Both are measurable within a quarter, which matters — an AI programme that cannot show a number in its first quarter rarely gets a second.
How we build it
We deploy agentic AI into your existing estate rather than around it, with the governance evidence assembled as the system is built.
Architecture that satisfies a supervisor
Decision logging with retrieved context retained, pinned model versions, evaluation gates in CI, and human-review routing defined by policy rather than by queue. Data flows are classified individually so only what genuinely requires EU-controlled infrastructure carries that cost.
Integration with the systems of record
Core banking, CRM, payment and ledger systems stay authoritative. Agents read, decide and act across them through governed interfaces.
Related work
Starting smaller
Scale-ups without a large compliance function typically start with document extraction in onboarding, then add adverse-media screening once the evaluation harness is in place. Both are narrow enough to ship in weeks and measurable enough to justify the next step.
Questions we get from fintech teams
Does DORA apply to our AI vendors?
If the service supports a critical or important function, it falls within the ICT third-party risk provisions — which means contractual requirements, exit planning and register entries. Treat an inference provider the same way you treat a core banking supplier, and record the assessment.
Can we use a US model provider at all?
Usually yes, for a defined subset of flows. The decision belongs at flow level rather than estate level: classify what data reaches the model, decide whether plaintext exposure is acceptable for that class, and route only the sensitive minority to EU-controlled infrastructure. Blanket answers in either direction cost more than they save.
How do we explain a model-assisted decline to a customer?
By logging the decision path as it happens — the inputs considered, the evidence retrieved and the rule or threshold that applied — rather than generating an explanation afterwards. Post-hoc rationalisation is not the same thing and does not hold up under challenge.
What should we build first?
Onboarding document extraction. It is bounded, high volume, has an unambiguous definition of correct, and produces a measurable cycle-time number inside a quarter.