Sardine

We're so excited to welcome three new Sardines to our ever growing school! Simona Suskeviciene is our new Compliance Solutions Strategist, working from Vilnius, Lithuania. She spent the last eight of her 13+ years in financial crime leading operations teams at two payments companies, and now brings that operator's view to our customers. When she's offline, you'll find her in the mountains, exploring the beautiful Lithuanian landscape. Joining as People Ops Partner is Hannah Noble, based in Uxbridge, Ontario. After rebuilding the Talent & Culture function at a fintech startup, she's now putting her HR tech and process know-how toward the employee experience here. Lately she's picked up wood carving and Polish (which our Polish Sardines will be happy to help her practice). Another addition to the Sardine crew in the DMV area, Beth Zhao joins as Corporate Counsel from Arlington, Virginia. After handling contract review at an enterprise AI company, she’s excited to come to Sardine and go deep on fraud and financial crime. Outside work, she's usually at a group fitness class or cheering on the Kansas City Chiefs during football season. Together they here to strengthen both the customer-facing side of compliance and the internal work that keeps a growing company swimming smoothly. Welcome aboard! 🐟🐟🐟

One Hub to rule them all. Agent Hub is live. Every Sardine AI agent now sits in one place, already loaded with the alert, customer, session, or transaction you have open. One does not simply paste 40 transaction IDs into a chat window anymore. Today, our fellowship of agents includes: • Rule Assistant • Data Analyst • Doc KYC • OSINT Search • Graph Analyst • Business Due Diligence • Compliance Screening Open a chat from whatever page you're on and put one to work. Doc KYC handles name variations across documents, which is how you work out that Sméagol and Gollum are the same applicant. Attach an agent to an alert queue and it lights like the beacons of Gondor, running on every new alert that arrives. The recurring reviews can go on a schedule, so they happen around second breakfast instead of whenever someone remembers to check. More than 450 customers have access today and are already telling fraudsters "you shall not pass!" with Sardine's agents. Read the full breakdown by Annie Liegel: https://lnkd.in/ev2eQrB6 And shoutout to Adam M. for the LotR inspiration! (Disclaimer: don't be a fool of a Took, Sardine Hub will not make you invisible nor will it help you conquer the world.)

We've got quite a week coming up! Next stops: 🌴 Sibos Miami 🌴 and 🎲 ACAMS Vegas 🎲 Soups Ranjan + Kimberly Lytle, Craig Wood, and Leo B. will be in Miami Sept 28-Oct 1 for Sibos, while the team also heads to Las Vegas Sept 29-Oct 1 for ACAMS The Assembly to connect with the banks and AML leaders working out what AI agents mean for financial crime. Banks already have AI agents triaging alerts, and the open question is how much of the investigation to hand them. Soups and Stan Szwalbenest of FIS take that up on October 1 with a Discovery Stage session called Machine speed: How AI agents are reshaping fraud operations. Over in Vegas, the team will be on the floor talking through how AI agents fit into AML programs that still answer to an examiner, from clearing alert backlogs to documenting every decision an agent makes along the way. Catch Soups on the Sibos stage October 1 at 1:30 p.m. Meet the team at ACAMS at booth #330 in Vegas: Jennifer Piercey, Kevin OBrien, Jona Holty, Maggie Parkhurst, Hailey Windham, CFCS, Heather DeMinck, AAP, APRP, CAMS, Naimur Rahman, Derek Chao, and Susan Hur

Karisse Hendrick and Sudhir Lanka have never met in person, though their easy back-and-forth on this week's Fraudology would suggest otherwise. Sudhir's team at GrubHub now covers Wonder and Blue Apron too, so they spend the episode nerding out on protecting every side of a marketplace. For diners, that can be as light as the PIN Karisse gave a driver outside her hotel on a recent trip. Sudhir calls it soft friction, since it costs her a few seconds after she's paid and keeps a stranger in the lobby from taking her dinner. Restaurant owners are tougher to protect because their trouble often starts in a personal inbox, and Sudhir says those cases hit him hardest. Once a fraudster is in, swapping the payout account can cost a small business money it was counting on before GrubHub sees a thing. Looking after both sides is also how Sudhir makes the business case, telling nearly everyone he meets that fraud strategy is pro-growth because people who trust a platform keep coming back. 🎙 LISTEN to the full episode >> https://lnkd.in/eZYJkywF ▶️ WATCH on YouTube >> https://lnkd.in/e7_3kxCN

Agent Hub is coming to Sardine. Every Sardine AI agent will run from one surface, each one starting with the case already in front of you. Open it on a customer, session, transaction, or alert and the agent works from that record instead of a blank prompt. Teams will be able to chat with an agent on whatever they're investigating, attach one to an alert queue so it runs on every new alert with that context in hand, or put one on a schedule for the recurring reviews that currently depend on someone remembering to check. The lineup covers almost all of an investigation: • Rule Assistant: drafts rules from plain language • Data Analyst: queries and validates in SardineQL • Graph Analyst: clusters IPs, emails, devices, crypto • OSINT Search: people, companies, addresses • Doc KYC, Business Due Diligence, Compliance Screening: identity, KYB, sanctions Agents will also come with evaluations, so a team can see how a new or updated one behaves across defined scenarios before it goes anywhere near a live queue. Read the full article by Annie Liegel: https://lnkd.in/ev2eQrB6

Pernicious. That was Scott Ellefson, CFE's one word for fraud in 2026 last month at IAFCI Nashville. The schemes he sees are the same ones he always has. The volume behind them is what's starting to overwhelm the people working them. Bust-out rings are his specialty, and they relocate as enforcement improves. What concentrated in California and Florida is now moving toward the middle of the country. Lenders that talk to each other catch these faster, since a ring that finished with one institution is usually already working the next. Groups like the Auto Finance Coalition keep drawing more participation for exactly that reason. Part three of Hailey Windham, CFCS's IAFCI run in Nashville has nine of these. This episode gets into: 🔹 Jen Lamont, CFE, CBSAP on income misrepresentation and consortium data over credit reports 🔹 The five minute phone call Jeff Taylor uses to stop business email compromise 🔹 Dealership lien stripping on cars financed and never delivered, from Monica White 🔹 Scott Anchin on check values rising as volume falls, and AI attacks at community banks Shoutout to everyone else who sat down with Hailey at IAFCI: Steve Lenderman, CFE, CFCI, Heather Noss, Chris Gergeni, MA, C.N.P., and Alec Glassman! 🎙 LISTEN to the full episode >> [EPISODE_URL] ▶️ WATCH on YouTube >> [EPISODE_URL]

An AI agent designed to unwind a card-testing pattern in minutes sits idle because no one's had the chance to open the tab and ask it to start. So it waits, and waits, and waits... The weekly card-testing scan and the monthly EDD cohort both depend on someone remembering to kick them off, capping the agent's output at whatever an analyst has bandwidth to start. Introducing: Agent Routines. Attach a schedule to an agent already running on the platform, hourly, daily, or monthly, and findings will reach your team without anyone starting the run. A few of the routines teams will be able to set up: • Overnight scans for card-testing bursts on a single card • Re-screens of the active book when a sanctions list updates • Daily checks on chargeback concentration by channel • Monthly EDD runs across a cohort, one report per entity • Re-checks of alerts cleared as false positives Findings will arrive in an inbox ranked by severity, and anyone can open a chat with the agent about what it flagged. The person reviewing that output still decides what happens next, which is where you wanted their attention to begin with. Read the full article by Annie Liegel: https://lnkd.in/eesVtUWV

Agent monitoring belongs to your fraud analytics function, and the tooling is the alerting and reporting stack you already run. Real-time alerts are the foundation layer of AI governance. Any time an agreement rate drops below it's threshold, or an autonomous agent's distribution skewing past a set rate, should fire into Slack or email and get looked at the same day. In part 4 of The Rise of Agentic Fraud Ops, Chen Zamir builds agent monitoring out of three layers, each running on a different clock: 🔹 Same-day triage on threshold breaches, fired automatically into Slack or email 🔹 Weekly trendline reviews that check reaction cycle speed even when no alert fired 🔹 Monthly cost and ROI reporting that goes to the leadership team An attack blocked four days faster is four days of losses you did not take, and that belongs in the ROI calculation next to the hours automation saves. 🎙 LISTEN to the full episode >> https://lnkd.in/eHtYnnXx

Next stop: Transformational Enterprise GRC Assembly 🐟 Ravi Loganathan is giving a talk at The Wigwam in Phoenix September 23 at 2:40pm on how scams became an enterprise legal liability. Most large companies have absorbed fraud as a cost of doing business for decades, with a team somewhere in operations to keep it inside budget. Deepfakes are cheap and convincing enough now that the losses have outgrown that arrangement. No company gets out of that alone. Two things stand in the way and both are legal questions: how much a company can lawfully tell another one about a fraud it caught, and who answers for an AI agent that makes the wrong call. Until somebody answers those, every company defends itself with only what it has seen happen to itself. Be sure to catch Ravi's session this Wednesday at 2:40pm.

We trained a foundation model on ten months of card transactions, fed its embeddings into the issuing fraud model we already run in production, and caught 24% to 35% more fraud at the same share of transactions flagged. Issuing is a thin signal per transaction. An authorization reaches the issuer last and carries a card, a terminal, an amount, a merchant category code and a timestamp, which is why the baseline runs on 77 features instead of several hundred. The depth is in the history. We keep up to 32,768 tokens per cardholder and the transformer reads it in overlapping chunks of roughly a hundred transactions, predicting the next token and never once seeing a fraud outcome. Labels enter only at the end, when the embeddings join those 77 features. What it learned also traveled. One client population was held out of pretraining entirely, its model built the way every other one is, and the embeddings improved it by 29%, with the gain concentrated in the shallowest bands where the model is most confident. We expected this to work on issuing and it did. Merchant data is close to the reverse, a wide mature feature set over a shopper who visits any one site rarely and often for the first time, and we expect much less there. Check out the full whitepaper here for all our insights: https://lnkd.in/e9cNtUFr