AI in FinTech doesn't die in dev. It dies in the audit room.
You ship a fraud model. Your auditor asks for the eval harness, drift monitoring, model card, and backtest. You have none of them. Or you have them but cannot find them. We have walked into that audit room before. We bring the evidence pack and the model that earned it.
Audit posture
Audit-ready by design
Model lifecycle
Eval, drift, model card · default
Boundary
Tokenisation at the edge
Code ownership
Yours · IP transfer at SOW
Six things we have shipped many times — for FinTech teams
What we actually build for FinTech teams. No jargon, no theatre.
Lending risk score
NBFC · BNPL · personal · SME
A blended scorecard trained on bureau data and bank-statement signal. Every decision carries feature attribution. Adverse-action notices generated automatically and mapped to your regulator's template.
Card and payment fraud
Real-time scoring · sub-second
Hybrid setup — supervised for known patterns, unsupervised for novel. The borderline band lands in a human-in-the-loop queue. Backtests reproducible from a script your team can run on demand.
KYC document automation
Aadhaar · PAN · passport · utility
Document AI for extraction, signature and face match, address proof reconciliation. Edge cases route to a queue with prefilled context — your reviewers see what was matched and what looked off.
Sanctions and AML triage
OFAC · UN · EU · DPL screening
Embedding-based name matching with transliteration handling for Hindi, Arabic, and CJK scripts. Compliance gets a triaged queue, not a haystack — every flag carries similarity scores and prior dispositions.
Dispute representment
Visa CE 3.0 · Mastercard Compelling
Reads the dispute reason code, gathers transaction evidence, drafts the representment packet. A human signs before submission. The agent learns from win-loss feedback across cycles.
Model risk pipeline
Common to every model above
Eval harness, drift monitoring, model card, backtesting evidence. Every production model ships with the artifact pack your auditor will accept on day one. We treat this as the substance behind the word "compliance".
How we operate · the substance behind "compliance"
Six positions we hold on every engagement. Non-negotiable.
01 · Compliance is the spec
Audit boundary first, capability second. The shape of the model is decided after we map your PCI-DSS scope, SOC 2 controls, and model risk policy. Compliance becomes the SOW, not an afterthought.
02 · Eval before vibe
An eval harness lands in your repo on day one. The target is locked in writing. We do not hand-tune until vibes are good — we hand-tune until the harness clears the line your team and your auditor agreed on.
03 · Tokenise at the edge
Cardholder data and PII never reach embedding models or LLM provider logs. Tokenisation at the boundary, redaction in the pipeline, mapping document on file. The model sees what it needs and nothing more.
04 · Roll out in tranches
Five percent traffic, then more if the KPIs hold. We have rolled back twice in 2025 — both before customer impact. That is what staging and tranche rollout are for.
05 · Drift is a job, not a chart
Drift monitoring is wired to your on-call, not just a Grafana panel. Quarterly model card refresh. The old model stays callable so your auditor can reproduce a backtest a year later.
06 · Hand the keys over
Model weights, prompts, eval fixtures, deployment scripts — all in your repo, licensed to you, never reused on other clients. If you fire us tomorrow, another partner picks it up on day one.
Regulatory map · jurisdictions we hold the line in
Frameworks we ship inside, mapped not promised.
We do not sign SOWs we cannot back. Below are the frameworks we have shipped inside as AI vendor of record. If yours is not listed, ask on the call — we will tell you on the call whether we can hold the line.
- PCI-DSS v4.0Cardholder data · tokenisationArchitecture-aligned
- SOC 2 Type IITrust services criteriaVendor of record
- GLBAUS customer financial infoDefault
- ISO 27001 / 27701ISMS + privacyAligned
- NIST AI RMFModel riskMapped
- EU AI ActHigh-risk classificationTracking
- RBI Master DirectionsIndia · NBFC + digital lendingAligned
- DPDP Act 2023India · personal dataAligned
- FFIECUS examination handbookMapped
Six-week build · tranche rollout · 90-day audit support
Audit boundary first. Capability second.
Week 1
Boundary + spec
Map PCI-DSS scope, SOC 2 controls, model risk policy. Eval target written into the SOW.
Week 2
Tokenisation layer
Boundary tokenisation, PII redaction pipeline, audit logging. Compliance pre-approved before code.
Week 3–4
Build + harness
Model code in your repo. Eval harness reproducible from a single command. Drift monitoring scaffolded.
Week 5
Backtest + shadow
Reproducible backtests. Shadow against live traffic for two weeks. Humans grade the diff.
Week 6
Tranche rollout
Small cohort first, ramp on schedule only if the KPIs hold. Audit logs streaming. Evidence pack assembled.
Day 90
Drift watch
Slack open. Quarterly model card refresh. Auditor follow-ups, if any, route through us.
NBFC lender · India + UAE
Three weeks before the audit window closed, they had no model card.
- Setting
- Personal + SME lending
- Audit
- RBI examination + SOC 2 Type II
- Pre-existing model
- In production · 14 months
- Findings on day one
- Three
- Outcome
- Clean audit · zero follow-ups
The lender had a credit model in production for over a year. It worked — until the auditor asked for the model card, the eval harness, and a backtest on the cohort that had defaulted hardest the previous quarter. Nobody could rerun the backtest. The model card had been written once and never updated. The Head of Risk had three weeks before the audit window closed.
We rebuilt the lifecycle in those three weeks. The eval harness ran from a single command against a labelled bureau-data fixture. The backtest was scripted, version-pinned, and reproducible against the auditor's chosen cohort on a screen-share. The model card was filled in line by line — feature lineage, intended use, known limitations, fairness slices across age and geography. Adverse-action notices were rewired to map to RBI master directions, not a US template the previous vendor had copy-pasted.
The audit closed clean. The replacement risk model — built on the new lifecycle from week one — went into production a few weeks later. The follow-on engagement is still running. We have built two more risk models on the same evidence pattern. The auditor signed off on those without a single follow-up.
Compliance and capability questions
Real answers from inside the audit room.
Bring one model · or one auditor finding
Thirty minutes. We tell you what evidence pack we'd build and how long it would take.
Walk us through a model you want to ship — or a finding your auditor opened. We map the path, the boundary, the timeline, and roughly what it would cost. No deck. No follow-up unless you ask.
- Vendor of record on SOC 2 Type II audits
- PCI-DSS v4.0 boundary tokenisation
- RBI / DPDP / GLBA aligned
- Code, models, prompts owned by you