Feedzai: the X-ray deck

The full X-ray of Feedzai · keys ← → · F fullscreen · A all slides. The plain-text version is this page's markdown twin (index.md).

X-rayed by RiskMandate

Feedzai

AI-native fraud and financial crime prevention for banks, now with Farol, an always-on agent for fraud and AML analysts, and a stated plan to tell good customer agents from bad ones.

Sources read on 2026-11-07 · web-summit.sgit.ai/xray/feedzai

What it does

Feedzai

Feedzai sells a RiskOps platform that banks, payment networks and acquirers use to detect and stop fraud, scams and money laundering in real time, unifying identity, behavioural, device, transaction and third-party signals from onboarding to remediation, with a separate network score (Feedzai IQ Score) delivered by API. Since 24 September 2026 the platform ships Farol, an embedded agent that retrieves and summarises alert data, analyses rule performance, drafts suspicious activity reports and answers product questions inside RiskOps Studio. Feedzai says it is building two more things for the agentic era: Bring Your Own Agent, to connect banks' own and partner agents to its platform, and detection that checks who authorised a customer's agent, what it may do and whether it still matches its intent.

Sources: s1, s4, s14, s3, s2, s6

Its AI agents

What acts on its own

FarolFeedzai's always-on AI agent, launched 24 September 2026 and built into RiskOps Studio. Analysts talk to it in plain language and it picks a skill: Risk Strategy, Investigations, SAR Narrative and Knowledge. Feedzai says it runs inside each institution's own environment, with traceable reasoning, transparent audit trails and what the launch release calls autonomous execution capabilities; analysts stay in control of actions.
  • Retrieves and summarises alert and case data and shows what triggered an alert
  • Interrogates rule sets, flags rules generating noise without catching fraud (for example rules that have not caught fraud in 30 days) and recommends sharper thresholds and production-ready rule suggestions
  • Turns case data into an evidence-backed SAR draft for investigator review
  • Answers how-to questions from product documentation with cited sources
  • Next step on the roadmap: proactive risk insights, flagging risks before it is asked
Bring Your Own AgentAn upcoming capability, still in development with customers invited to test it: banks connect their own or partner-built agents, with their choice of model, to Feedzai's data, intelligence and workflows through a secure connection. Feedzai's blog says these agents connect via a Model Context Protocol gateway and inherit the platform's permissions and audit trail.
  • Connects a bank's own or third-party agents to Feedzai data, intelligence and workflows
  • Runs them alongside Farol from the same context, as one connected system
  • Routes them through one gateway, one audit trail and one set of controls (as described by Feedzai)
Agentic Detection (KYA)Not an agent Feedzai runs today but the detection it says it is building to watch the agents that reach banks: telling legitimate customer agents from agent takeovers, agent botnets and malware, and checking who authorised an agent, what it is allowed to do and whether its behaviour still matches its intent. Feedzai calls the wider idea Know Your Agent (KYA). Its CTO's Web Summit 2026 session, "Who let the agent in?", is about building agents with identity, boundaries and accountability.
  • Detects agents in banking traffic and classifies their intent (in development)
  • Verifies who authorised an agent and what it is allowed to do (in development)
  • Checks whether an agent's behaviour still matches its original intent, aiming to stop malicious agents before they act (in development)

Use case · Agentic Detection (KYA)

A customer's agent moves money at a Feedzai bank

Reach
  • The customer's online banking session: the agent logs in on the customer's behalf system
  • The customer's money: the agent pays bills and moves money, and Feedzai expects agents to approve transactions on users' behalf money
  • Real-time payment rails (instant payments such as Pix, and Canada's Real-Time Rail) that clear and settle in seconds, around the clock money
  • Feedzai's real-time scoring of the session and payment: behavioural biometrics, device intelligence, transaction and network signals data
  • Malicious agents that look identical to customers' agents: agent takeovers, agent botnets and agentic malware outside
Mandate (illustrative)
  • Illustrative: the customer authorises the agent to pay named recurring bills from one account, up to a monthly limit
  • Illustrative: the agent may not add payees, raise limits or send money to a new beneficiary without the customer confirming
Gap
  • The bank's identity checks were built to verify a human; Feedzai itself says what an agent is allowed to do, on whose authority and within what limits is not yet established, and that live registries of authorised agents will be needed. Until then the customer's limits live only between the customer and the agent.
  • An instant payment clears in seconds, so any check on whether the agent is still within its limits has to happen before the money moves, not after.
  • A malicious agent can look identical to the customer's agent; the detection meant to tell them apart is still being built.

Use case · Farol

Farol inside a bank's fraud and AML team

Reach
  • Alert and case data in the institution's fraud and AML stack, and the analyst tools around it data
  • Rule sets, rule performance, coverage gaps and thresholds system
  • Production-ready rule suggestions and what the launch release calls autonomous execution capabilities in risk workflows system
  • Suspicious Activity Report drafts built from case data, about named customers, for local filing requirements people
  • Product documentation, answered in plain language with cited sources data
Mandate (illustrative)
  • As Feedzai documents it: agents surface insights and recommendations with transparent reasoning, and analysts verify outcomes and take actions as they see fit
  • Illustrative: the bank lets Farol read alerts and draft; any rule change goes through challenger testing and a named approver, and only an investigator files a SAR
Gap
  • The launch release speaks of autonomous execution and production-ready rule suggestions, while the product page says analysts take the actions; which actions Farol can take on its own in a given deployment is not public.
  • A SAR draft about a named customer is one click from case data; Feedzai's own blog says the final call to file must be documented and attributed to a named human.

Use case · Bring Your Own Agent

A bank's own agents through Bring Your Own Agent

Reach
  • Feedzai's data, intelligence and workflows, the same context Farol works from data
  • A Model Context Protocol gateway through which connected agents inherit the platform's permissions and audit trail system
  • Third-party partner agents and the bank's choice of model outside
  • Bank workflows reached through a secure connection system
Mandate (illustrative)
  • Illustrative: the bank's own agent reads alert context for one queue and writes notes, nothing else
  • Illustrative: a partner agent is read-only and sees no customer data beyond the case it is asked about
Gap
  • Agents that inherit the platform's permissions reach whatever the platform role they run under reaches; how narrowly one connected agent can be scoped is not yet documented.
  • A partner agent on a model of the bank's choice works from the same context as Feedzai's own agents; where that data goes for inference is outside Feedzai's estate.

The simulation · A customer's agent moves money at a Feedzai bank

Each action, placed against the mandate

  1. The customer sets up a personal agent to pay their utility and phone bills from their current account (illustrative) in the mandate
  2. The agent logs in to online banking on the customer's behalf; Feedzai scores the session's device and behaviour signals (illustrative) in the mandate
  3. Pays the month's utility bill to an existing payee (illustrative) in the mandate
  4. Reads an email claiming the energy supplier's bank details changed, adds the new account as a payee and approves the payment itself (illustrative) in the gap
    The record: RiskMandate's record shows the agent could add a payee and approve a payment to it, while the mandate was existing payees only, and that the customer's limits were held by the agent alone, with no registered permission the bank could check.
  5. The payment goes out on an instant rail and settles in seconds (illustrative) in the gap
    The record: RiskMandate's record shows the exposure as the full payment on a rail that settles in seconds, with the bank's real-time scoring as the only documented control in front of it.
  6. A week later a different agent, presenting like the customer's own, logs in with a stolen session and starts moving money (illustrative) in the gap
    The record: RiskMandate's record shows a reach no mandate covers: an outside agent indistinguishable from the authorised one, and that the detection meant to tell them apart is described by Feedzai as in development.

What RiskMandate gives

RiskMandate is never in the request path: read-only by design.

It measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record.

riskmandate.ai/llms.txt

Sources

Every fact, with its source and the date read

And 18 more on the X-ray page.

The questions we would ask

We have not asked them yet

  1. When Farol uses what your launch release calls autonomous execution, which actions can it take without an analyst approving them (changing a live rule, closing an alert, filing a SAR), and who in the bank sets that line?
  2. Agents connected through Bring Your Own Agent inherit the platform's permissions: can a bank scope one connected agent below the role it connects under, and is each action attributed to that agent and to a named human in the audit trail?
  3. For Know Your Agent: when a customer's agent arrives at a bank, what will your detection read to learn the limits the customer set, and what happens to a payment that is outside them on a rail that settles in seconds?
  4. Farol runs inside the institution's environment: which model providers does it call, and does any case or customer data leave the bank's estate for inference?
  5. Can a bank export Farol's record of what it retrieved, recommended and who acted on it into its own model risk records, so a supervisor can see who authorised each step?

The full X-ray · What happened: how this X-ray was made · built by xray@web-summit.dinis

For an agent: this page is https://web-summit.sgit.ai/xray/feedzai/deck/index.html (markdown: https://web-summit.sgit.ai/xray/feedzai/deck/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.