solutions · fintech
Wytness for fintech
Audit agent activity to a standard your regulator accepts.
the question every regulator asks
Can you produce the evidence?
APRA CPS 230/234, the FCA's SYSC 8.1, OCC model-risk guidance, FINRA Notice 24-09, and the EU AI Act (credit scoring is high-risk under Annex III §5(b)) converge on one question: when an agent makes a decision affecting a customer or a position, can you produce the evidence? Application logs, LLM traces, and SIEM events aren't it. They're not tamper-evident, they're not tied to an agent identity, and they leak PANs into places PCI-DSS says they must never reach.
a scenario
A CPS 234 review, with and without
A Sydney neobank triages card disputes with LangChain agents — four thousand a month. At review, the APRA-regulated parent is asked to evidence fifty auto-resolutions: exact tool calls, data retrieved, decisions made, and proof no PAN left the environment.
Without Wytness that's CloudWatch, LangSmith, and Snowflake — three systems, no shared identity, PANs in all of them. With it, it's one signed Ledger export: agent, tool calls, tokenised PANs, decision, human-review flag, chain links — mapped to CPS 234 §35. An afternoon, not three weeks.
// Event identity:
// What the agent did:
// Parameters (PII tokenised before this row was sealed):
// Integrity proof (3-layer):
one auto-refund from the scenario — the PAN never appears because it never left the bank
the deliverable
What you can prove
- ✓Which agent made which credit, KYC, or sanctions decision, down to the model version and prompt fingerprint.
- ✓That every decision affecting a customer was reviewable by a human before it went out, where your policy requires it.
- ✓That no agent retrieved or output a primary account number, full card data, or any PCI-scope field outside an approved tool path.
- ✓That the audit trail was tamper-evident: Ed25519 signatures and hash-chain links your auditor can independently verify.
- ✓That a regulator's request for a six-month transaction history of agent activity can be answered in hours, not a discovery exercise.
how the surfaces map
Three surfaces, one product.
/product/ledger
Ledger
Signed events, PCI-scope fields tokenised in your runtime, BYOS into your tenancy, Evidence Packs mapped to SOC 2 CC7.2, EU AI Act Articles 12–13, ISO 27001 A.8.15.
/product/registry
Registry
Agent, tool, and model-version inventory; drift after a model upgrade shows up as a change in tool-use distribution, not a war-room reconstruction.
/product/shield
Shield
Approval gates on credit decisions, sanctions overrides, and refunds, routed to ServiceNow GRC or the compliance Slack channel.
for your auditor
Frameworks that matter here
SOC 2 Type II
Trust services criteria for the audit pipeline itself.
ISO 27001:2022
Control set your bank's vendor risk team already speaks.
EU AI Act
Credit scoring is high-risk under Annex III §5(b).
GDPR
Article 22 covers solely-automated decisions with legal effect.
APRA CPS 230 / 234
§47 incident management, §35 incident response — control matrix in progress.
PCI-DSS v4.0
Audit-evidence support alongside a PCI-compliant processor; direct cardholder-data handling is out of scope.
MAS TRM Guidelines
Framework alignment available on request.
the boundary
What Wytness does not do
- —We are not a GRC platform. Wytness feeds evidence into your existing GRC (ServiceNow, Archer, OneTrust); it does not replace them.
- —We do not do post-trade reconciliation, settlement, or transaction monitoring. We log what your agents did; the trading and risk systems remain yours.
- —We are not a model risk management framework. We give your MRM team the evidence they need to apply OCC 2011-12 or SS1/23 to AI agents; the policy work is theirs.