Depository credit intermediation

A core replacement is the single riskiest project a bank undertakes — ledger, deposits, payments and regulatory reporting move at once — so cores are replaced roughly once a generation. The incumbents' position rests on that, not on product quality. The modern challengers (Mambu, Thought Machine, 10x) have each raised hundreds of millions and are still fighting for reference customers a decade in.

The asset in this category is a shared data network, not the software, and the people who own the largest networks are buying the vendors. FICO's FY2025 10-K says its fraud models are trained on transaction data from more than 10,000 institutions in the FICO Falcon Intelligence Network [A]. Riskified's FY2025 20-F reports $155.1B of ecommerce orders reviewed, about 2.5% of global ecommerce by its own calculation [A]. That is what an entrant cannot copy. A new model on day one has seen no fraud, and the buyer is paying for what the model has seen. The exits tell the same story. Visa bought Featurespace in December 2024 for $946M (Visa FY2025 10-K) [A]. Mastercard's FY2025 10-K describes Recorded Future as part of its fraud and cyber offering [A]. Entrust bought Onfido in April 2024, and onfido.com now redirects to entrust.com [B]. Permira took majority control of BioCatch at a $1.3B valuation in September 2024 [B]. Socure bought Effectiv for about $136M in late 2024 [B]. In each case the buyer already owned traffic, a payment network or a bureau. The listed pure-plays are not growing fast. NICE's Financial Crime and Compliance segment, which is mostly Actimize, earned $485.4M in 2025, up 7.0% [A]. FICO's whole Software segment earned $822.3M, up 3%, with software ARR up 4% [A]. FICO does not break out fraud revenue. Riskified earned $344.6M, up 5.2%, with a net loss of $27.6M [A]. Mitek earned $179.7M, up 4% [A]. Meanwhile the bureaus get bigger. RELX's Risk segment, which includes LexisNexis Risk Solutions, earned £3,485M in 2025 with 8% underlying growth. RELX names "digital Fraud & Identity" as one of the drivers [A]. How this differs from the neighbouring records. The regtech and compliance automation record (5223) covers AML transaction monitoring, sanctions and KYC case management, a budget the bank spends because a regulator requires it. This record covers the loss budget: card and payment fraud, account takeover, application fraud, identity proofing at onboarding, and chargebacks. The two overlap at NICE, Feedzai and Sardine, which sell both. The core banking record (5221) is the ledger these tools plug into. The embedded payments record (522390) is the rail whose risk this software scores. The wider sector is mapped on the fintech topic page. The 5221 anchor (depository credit intermediation) is the anchor buyer. The same software is sold to payments companies and processors (522320), consumer lenders (5222), e-commerce retailers and marketplaces (4541, 459), and gig and crypto platforms. Incumbent vulnerability decides it. The large data networks are owned by companies whose main business is elsewhere, and they treat fraud scoring as a feature of the network. That leaves an independent to sell either to a long tail of fintechs that have little data of their own, or to be acquired by one of those companies.