Agent-control plane for global-bank sanctions investigations, letting AI caseworkers gather evidence under local policy and audit trace.

1. Financial-crime buyers are moving from chatbot experiments to software that can let AI execute real investigation steps.
2. Any bank deploying agentic workflows now must prove governance, explainability, and human review before compliance will let automation touch live cases.
3. Cross-border banks cannot ship one universal agent because regional policy and data rules differ, turning localization into immediate software work rather than a later feature request.
4. The size of Quantifind's growth round suggests control software around risk operations is no longer a niche budget but a venture-scale category.

Catalyst. Quantifind's $200 million investment around Graphyte Agentic Middleware, regulatory alignment, and localized risk intelligence signals that banks now want AI to execute fincrime work, but only through a governed layer that can survive region-by-region oversight.

The product sits above existing case management and screening systems rather than replacing them. It ingests case metadata, customer records, prior alert outcomes, and local policy rules, then spins up least- privilege agents for narrowly defined tasks such as gathering adverse media, mapping beneficial ownership, or reconciling payment-chain inconsistencies. A supervisor layer checks every agent action against jurisdictional policy packs, requires human approval for sensitive steps, and generates cited investigation memos in the format each regional team already uses. The bank gets faster case assembly without handing a general-purpose agent unchecked access to regulated workflows. Over time, the company compounds an action- outcome dataset showing which agent playbooks clear alerts fastest without breaching policy.

What's different. Incumbent AML platforms store cases and risk data, while consulting firms write policy documents and shared services execute manual research. This company owns the control runtime between them: which agent may do what, with which data, under which regional policy, and with which human checkpoint. Its defensibility comes from jurisdiction pack libraries, connector coverage, and a growing corpus of action-level investigation traces that show how governed agent workflows actually perform in production.

Jobs to be done

flowchart LR
  Buyer[Global bank sanctions lead] --> Pain[AI pilots stall on policy variance]
  Pain --> Product[Sanctions agent control plane]
  Product --> Outcome[Faster investigations with audit-ready oversight]

Executive takeaways

• The pain is real, but the wedge is narrower than generic AML AI: banks already buy detection and case systems, yet still lack a governed runtime for semi-autonomous investigation work across jurisdictions.
• Why now is strong because AI adoption has become mainstream in financial services, but regulators and buyers still expect human checkpoints, auditability, and explainable controls before agents touch live cases.
• Competition is intense from AML suites, decision-intelligence platforms, and new agentic vendors, so the startup only wins if it becomes the cross-stack control plane rather than another point solution.
• London, Dubai, and Singapore are attractive because cross-border sanctions and AML processes are complex, but jurisdiction-pack maintenance is a real operating risk and should be validated early.

Market definition

This category is governed agent infrastructure for sanctions and AML investigations: a control layer that sits above screening engines, case systems, and data vendors to let bounded AI caseworkers gather evidence, draft memos, and route exceptions under bank-specific policy.

Customer and buyer

The economic buyer is a global head of financial crime, sanctions, or compliance operations at a large bank. Day-to-day champions are sanctions investigations leaders, AML transformation leads, QA managers, and policy owners who need faster case throughput without losing control of reviewer checkpoints and audit trace.

Buying triggers

• Rising compliance cost and screening-alert growth make investigation productivity an immediate budget problem rather than an experimental AI project. [95][97]
• Banks are already adopting AI, but most automated use cases still keep humans in the loop, which creates demand for a governed agent runtime instead of an unconstrained copilot. [79][80][88][89]
• Cross-border sanctions obligations and targeted-financial-sanctions rules create pressure to encode local policy and escalation logic by jurisdiction. [76][99][101][102]

Willingness to pay

Budget exists inside financial-crime modernization and investigations operations: banks already spend tens or hundreds of millions on compliance work, and incumbent vendors already sell enterprise AML and case-management layers, so a governed control plane can fit an existing spend category if it demonstrably cuts manual review and audit friction. [95][96][69][41]

Category dynamics

Growth signal 13.6% y/y increase in U.S./Canada financial-crime compliance cost (2022 demand proxy)

Validation signals

• Quantifind’s $200M growth round explicitly around AI-native risk intelligence and agentic middleware validates venture-scale interest in the control layer around fincrime operations.
• NICE Actimize and Quantexa both now market agentic or agent-ready financial-crime offerings, showing buyers are moving past generic copilots toward controlled execution.
• Fenergo reports that tackling financial crime is the top AI investment priority in 2025 and that 47% of surveyed UK/US institutions already use AI in compliance operations.
• Screening vendors now market hard automation claims such as 65-85% routine false-positive remediation or material false-positive reduction, confirming that buyers want measurable workflow improvement.

Regulatory & technical constraints

• Any system used in sanctions workflows must support a risk-based compliance program with management commitment, risk assessment, internal controls, testing/auditing, and training.
• Dubai/UAE deployments must incorporate targeted-financial-sanctions processes, policies, and penalties under the UAE framework rather than rely on generic global configurations.
• Entity resolution, data unification, and context assembly are core technical constraints because legacy AML tools rarely give investigators a complete counterparty view by default.
• UK sanctions compliance requires frequent policy updates and clear operational understanding, which pushes product design toward configurable policy packs rather than hard-coded workflows.

Most rivals attack adjacent control points rather than the exact one proposed here. NICE Actimize owns broad AML and case management, Quantexa owns connected-data and contextual decisioning, Quantifind and ComplyAdvantage push screening and risk-intelligence automation, and Lucinity pushes AI-native investigator workflow. The opening is a neutral control plane that governs what agents may do across those systems, with jurisdiction-aware policies and evidence-grade traceability.

Why incumbents do not win by default

• Cloud platforms. Cloud and standards layers provide guardrails and risk-management primitives, but they do not ship bank-ready sanctions policy packs, reviewer workflows, or mixed-stack case connectors by default.
• AML suites. Incumbent AML suites can embed agentic features and auditable case management, yet buyers still operate heterogeneous stacks and cross-jurisdiction processes that create room for a neutral orchestration layer.
• Decision-intelligence platforms. Connected-data platforms are strong at context, entity resolution, and detection, but that does not automatically make them the permissioning and approval runtime for every downstream investigator action.
• Screening and risk-data vendors. Screening vendors can auto-resolve routine alerts and improve risk intelligence, but the bank still needs a layer that decides when an agent may act, who approves, and how outputs become defensible evidence.

Sanctions agent control plane is a governed investigation runtime for global banks that want AI to perform evidence-gathering work inside sanctions and AML investigations without failing compliance review. The beachhead is Tier-1 and Tier-2 transaction banks running cross-border alert queues across London, Dubai, and Singapore, where one global case flow meets different sanctions, AML, and data-sharing rules. The first product is not a new screening engine; it is a control plane that launches bounded AI caseworkers for payment-chain tracing, beneficial-ownership lookup, adverse-media gathering, and prior-case retrieval, then routes exception-scored drafts to human investigators with full action provenance. That wedge matches the clearest buying trigger in the research: a bank approves an AI pilot or opens a new regional booking center and must define what agents may do before touching live cases. Go-to-market should start with one sanctions queue, one incumbent case stack, and three jurisdiction packs because proof on cycle time and auditability matters more than broad workflow coverage. Banks already spend against financial-crime modernization and investigations operations, so the company can fit an existing budget line if it demonstrates measurable throughput gains. The main strategic risk is not model quality; it is whether policy-pack upkeep and enterprise integrations can stay software-like enough to preserve 70% gross margin. Research supports strong pain and timing, but it does not provide named customer references or direct proof that banks will buy a neutral control plane rather than wait for NICE, Quantexa, or services partners, so the first 12 months must validate paid pilots and pilot-to-production conversion.

Problem

• Cross-border sanctions and AML investigations still bounce among case tools, screening systems, data vendors, shared drives, and offshore analyst handoffs, which keeps case assembly slow and QA-heavy.
• AI pilots stall before production because banks cannot prove what an agent may access, draft, or escalate under UK, UAE, and Singapore policy and review rules.

Solution

• Deploy a neutral control plane above existing case-management, screening, and data systems that launches least-privilege agents for bounded evidence-gathering tasks under jurisdiction-specific policy packs.
• Record every agent action, evidence pull, reviewer edit, and final case outcome in an audit graph so banks can defend investigations and improve playbooks over time.

Why we win

• We start at the narrowest point of highest buyer anxiety: one cross-border sanctions queue where AI is useful now but governance blocks production, so the product augments existing stacks instead of asking for a rip-and-replace.
• Jurisdiction packs, cross-vendor connectors, and action-outcome traces create workflow-specific defensibility that generic copilots, advisory firms, and single-platform features do not compound as quickly.

Milestones

flowchart LR
  Wedge[Cross-border sanctions queue] --> MVP[Bounded evidence-gathering agents]
  MVP --> Proof[Cycle-time reduction plus audit trace]
  Proof --> Expansion[More jurisdiction packs and adjacent workflows]

Founding team

Experiment roadmap

Risk assessment

What must be true

• At least one target-bank segment treats governed AI investigations as a current 12-month buying priority with a named budget owner.
• A neutral overlay can land beside NICE Actimize or Quantexa without forcing a multiyear platform replacement.
• The first packaged deployment can connect one live queue, one case system, and key data sources in under 90 days.
• Governed agents can reduce median evidence-gathering or case-assembly time by at least 30% without creating audit exceptions.
• UK, UAE, and Singapore policy-pack maintenance can be handled with software and limited policy ops while preserving 70% gross margin.

Open diligence questions

• Which executive truly owns the budget: financial-crime operations, compliance, transaction-banking COO, or the incumbent transformation program?
• Can the first deployment plug into a live NICE Actimize or Quantexa workflow without a multi-quarter security review?
• What cycle-time and QA gains are required for a bank to justify $350k-$750k annual spend?
• How often do UK, UAE, and Singapore policy packs change, and what staffing model keeps them current?
• Why will banks buy this overlay instead of accepting Lucinity, Quantifind, NICE Actimize, or integrator-led alternatives?

Model sanity

• Revenue engine. Base revenue comes from growing paying banks from 2 at Y1 exit to 10 at Q4Y3 while blended annualized revenue per bank climbs from about $570K to $750K as second packs and adjacent workflows attach.
• Must go right. The deployment playbook has to compress toward the business plan's sub-8-week packaging target so a 14-person team can support 5 banks by Q4Y2 and 10 by Q4Y3 without dragging gross margin below target.
• Model breaks if. If pilot-to-production cycles slip a quarter or policy-pack upkeep keeps gross margin in the mid-60s, the downside case drives the cash floor toward roughly $250K before seed-ready proof appears.
• Next-round proof. The seed story is 7 paying banks by Q2Y3, at least 2 in-logo expansions, partner-sourced pilots that convert, and quarterly EBITDA turning positive before the pre-seed cash floor tightens.

Scenarios

Sensitivity

flowchart LR
  DesignPartners[Design partners] --> PaidPilots[Paid pilots]
  PaidPilots --> ProductionBanks[Production banks]
  ProductionBanks --> ExpansionPacks[More packs and adjacent workflows]
  ExpansionPacks --> Revenue[Revenue]
  Revenue --> GrossProfit[Gross profit]
  GrossProfit --> Cash[Cash and runway]

Flags: CustomersEop counts paid pilots as paying banks in Y1 and early Y2, so true production-bank count is lower than the headline customer total until late Y2. · The Q4Y3 exit ARPU reaches the researched $750K annual spend level, so second-pack or adjacent-workflow expansion must land in several logos rather than pure single-queue pricing. · Revenue concentration stays high because Q4Y3 still depends on 10 banks; losing one renewal would move both growth and cash materially. · Cash uses EBITDA as a proxy, so enterprise billing milestones, implementation prepayments, or deferred revenue could shift the actual low point.

• Policy-pack maintenance burden. Keeping jurisdiction rules current across sanctions, AML, and data-sharing regimes could become operationally heavy and slow expansion. Mitigation: Start with three financial hubs, build modular policy packs, and pair product updates with regional advisory partners.
• Pilot-to-production skepticism. Bank compliance teams may approve read-only experiments but resist giving agents live workflow authority. Mitigation: Launch with bounded evidence-gathering tasks, mandatory human checkpoints, and action-level logs before offering deeper automation.
• Incumbent workflow bundling. Case-management or screening vendors could add lightweight agent controls and bundle them into existing bank contracts. Mitigation: Win on cross-vendor governance, jurisdiction specificity, and faster deployment across mixed stacks that single-vendor tools do not cover.