When the Business Case Isn't the Law: Building Fraud Risk Intelligence Beyond Compliance

Transcript

1. Data Expo Utrecht 9 Sep 2026 When the Business Case Isn't the Law Building Fraud Risk Intelligence beyond compliance Friso Schutte CTO, SurePay Sinan Çalışır Machine Learning Engineer, Xebia 1
2. Agenda 01 About SurePay 02 Compliance tailwind 03 Fraud Risk Intelligence platform 04 Under the hood 05 Lessons learned & Next steps Two halves: the strategy behind the platform, then how it is actually built. Friso Schutte CTO, SurePay Sinan Çalışır ML Engineer, Xebia Prohibited to copy or re-use without the prior permission of SurePay 2
3. About SurePay 01 What we do, and at what scale 3
4. Prohibited to copy or re-use without the prior permission of SurePay 4
5. You might know us • IBAN-Name check • Naam-Nummer controle • Account check • Confirmation of Payee • Verification of Payee Prohibited to copy or re-use without the prior permission of SurePay 5
6. The rail we're building on How VOP moves data today Banking apps Financial organisations SaaS on AWS · EU-hosted API Portal File-based checks Payee bank Account data Name matching Data integration Other sources Prohibited to copy or re-use without the prior permission of SurePay 6
7. At scale Already running at European scale 20+ Million 250+ Checks every day Banks connected 12+ Billion 20.000+ Checks performed Organisations protected Prohibited to copy or re-use without the prior permission of SurePay 7
8. Efficient Reducing fraud Prohibited to copy or re-use without the prior permission of SurePay 8
9. Compliance tailwind 02 Every milestone so far had a deadline attached 9
10. Netherlands NL Highlevel Architecture Bank Banking apps Financial organisations SurePay Bank Portal Bank File based checks Other Manual Sources Manual files files Bank Prohibited to copy or re-use without the prior permission of SurePay 10
11. Where we come from From IBAN check to EU-wide mandate Regulation made the business case for us. 2016-18 IBAN-Naam Check 2019-24 UK Confirmation of Payee 2025 VOP mandatory, EU-wide 2027 Non-euro countries follow That is about to change. Prohibited to copy or re-use without the prior permission of SurePay 11
12. UK Confirmation of Payee CoP Scheme Open Banking OAuth2 & OpenID Connect Prohibited to copy or re-use without the prior permission of SurePay 12
13. UK UK Highlevel Architecture CoP Responder CoP Requester Bank CoP Scheme Bank Bank Bank Directory 13
14. EU EU Highlevel Architecture VOP Responder VOP Requester Bank VOP Scheme Bank Bank Bank Directory 14
15. Data The data challenge CoP/VOP Scheme CoP/VOP Responder CoP/VOP Requester Bank 15
16. Data The data challenge CoP/VOP Scheme CoP/VOP Responder CoP/VOP Requester Bank Data Au 16
17. The FRI platform 03 From banks to a real-time risk score 17
18. Nobody has to buy this one. VOP was mandated. Fraud Risk Intelligence has to earn its adoption. 18
19. The next step From verify-and-forget to verify-and-learn VOP Mandatory across the EU Adoption guaranteed Checked once, then discarded Fraud Risk Intelligence Same data. Same integrations. Same trust. Built on top of VOP Different business model. Earns adoption on value Every check enriches the profile Prohibited to copy or re-use without the prior permission of SurePay 19
20. How we mine it Refining data into intelligence Intelligence Derived data External sources Each layer refines the one below it. Account context Data exchange Prohibited to copy or re-use without the prior permission of SurePay 20
21. How it fits together Same rails, one layer up Third-party sources Banks & PSPs 250+ in Europe Fraud Risk Intelligence Data lake · SageMaker · Real-time scoring Risk score Sub-second EU/EEA hosted, multi-region Prohibited to copy or re-use without the prior permission of SurePay 21
22. Prohibited to copy or re-use without the prior permission of SurePay 22
23. Part 2 Under the hood Sinan Calisir · Machine Learning Engineer, Xebia / SurePay 04 23
24. The data lake Where all our data comes together. 01 02 03 Combine Validate Serve Every source into one place. Glue in, Iceberg tables out. Refined layer by layer, bronze through gold. Consumers read gold. Nothing reads raw. Why it matters here Our ML pipeline is one of those consumers. It starts from this output. Bronze Silver Gold Prohibited to copy or re-use without the prior permission of SurePay 24
25. The journey From the lake to a reason a human can act on. 01 02 Read from the lake Build features, run experiments One governed source, versioned per run. A notebook or a full training run. 03 Record every candidate Metrics, artefacts, registry, gates. 04 05 06 Score batch or realtime Capture and compare Return reasons, not a score A whole table, or one transaction. Live traffic against the baseline. Expert reason codes plus SHAP. Prohibited to copy or re-use without the prior permission of SurePay 25
26. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest ML platform 1 Orchestration backbone Monitoring and explainability Medallion lake Consumer serving Serving CI/CD and deployment Training and model management Experimentation and development Feature layer Prohibited to copy or re-use without the prior permission of SurePay 26
27. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest Orchestration backbone ML platform 1 Monitoring and explainability Medallion lake Serving Consumer serving CI/CD and deployment Training and model management Experimentation and development Dev environment Experiment tracking Feature layer Offline feature store Realtime features 2 2 Prohibited to copy or re-use without the prior permission of SurePay 27
28. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest Orchestration backbone ML platform 1 Monitoring and explainability Medallion lake Serving Consumer serving CI/CD and deployment Tests and quality gates Promotion 3 Training and model management Model training Model registry Experimentation and development Dev environment Experiment tracking Feature layer Offline feature store Realtime features 2 Evaluation pipeline 3 3 2 Prohibited to copy or re-use without the prior permission of SurePay 28
29. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest Orchestration backbone ML platform 1 Monitoring and explainability Medallion lake Serving Consumer serving Approve and serve Champion / challenger CI/CD and deployment Tests and quality gates Promotion 3 Training and model management Model training Model registry Experimentation and development Dev environment Experiment tracking Feature layer Offline feature store Realtime features 4 2 Evaluation pipeline 3 3 2 Prohibited to copy or re-use without the prior permission of SurePay 29
30. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest Medallion lake Orchestration backbone ML platform 1 Monitoring and explainability 5 Monitoring Serving Consumer serving Approve and serve Champion / challenger CI/CD and deployment Tests and quality gates Promotion 3 Training and model management Model training Model registry Experimentation and development Dev environment Experiment tracking Feature layer Offline feature store Realtime features 4 2 Evaluation pipeline 3 3 2 Prohibited to copy or re-use without the prior permission of SurePay 30
31. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest Medallion lake Orchestration backbone ML platform 1 Monitoring and explainability 5 Monitoring Explainability Serving Consumer serving Approve and serve Champion / challenger CI/CD and deployment Tests and quality gates Promotion Model training Model registry Experimentation and development Experiment tracking Feature layer Offline feature store Realtime features 4 3 Training and model management Dev environment 6 2 Evaluation pipeline 3 3 2 Prohibited to copy or re-use without the prior permission of SurePay 31
32. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest 1 ML platform Orchestration backbone Monitoring and explainability Pipeline orchestration 5 Monitoring Medallion lake Serving Consumer serving Streaming Explainability 7 Approve and serve Champion / challenger CI/CD and deployment Tests and quality gates Promotion 3 Ways of working Training and model management Model training Model registry Experimentation and development Dev environment Experiment tracking Feature layer Offline feature store Realtime features 2 2 Evaluation pipeline Backtesting / replay 6 Scheduling 4 Event-driven triggers 7 7 7 7 3 3 7 Prohibited to copy or re-use without the prior permission of SurePay 32
33. What the platform is made of Eight groups, twenty-two components. Data lake and pipelines Sources and ingest 1 ML platform Orchestration backbone Monitoring and explainability Pipeline orchestration 5 Monitoring Medallion lake Serving Consumer serving Streaming Explainability 7 Approve and serve Champion / challenger CI/CD and deployment Tests and quality gates Promotion 3 Ways of working Training and model management Model training Model registry Experimentation and development Dev environment Experiment tracking Feature layer Offline feature store Realtime features 2 2 Evaluation pipeline Backtesting / replay 6 Scheduling 4 Event-driven triggers 7 7 7 7 3 3 7 Prohibited to copy or re-use without the prior permission of SurePay 33
34. Our inference flow One request, end to end. 01 02 03 Payment arrives Historical features read Real-time features calculated From the PSP, over the VoP rail. Looked up from the feature store. Derived in the request path. 04 05 06 Model scores the payment Reason codes added Outcome monitored A risk score on the resolved row. Attribution turned into explanations. Captured and compared to the baseline. Placeholder — flow to be confirmed with the team 34
35. Lessons learned 05 What we would tell you before you start 35
36. The challenges What makes the problem hard. Regulatory constraints Cross-border data use inside the EU. Class imbalance Fraud is rare, so naive accuracy means nothing. Reasons without labels Unsupervised scores are hard to turn into reason codes. Slow feedback Supervised labels can take weeks or months to arrive. Supervised vs unsupervised Which framing we commit to, and what each one costs us. Thresholds need experts RC1, RC2 and the VoP-check codes each need a domain-set boundary. Placeholder — challenges to be expanded 36
37. Lessons and next steps What we learned, and what is next. Fraud evolves New patterns appear constantly. Models go obsolete over time, so retraining cadence is part of the product. Real time is mandatory The outcome has to arrive with most up-to-date view while the payment is still in flight. Next steps Add more data sources Multiple sources, from lake to prediction. Validating with the customers Ongoing efforts, and collecting feedback. Placeholder — lessons and next steps to be expanded 37
38. Thank you A goldmine of VOP data, built to earn its adoption. Questions? Friso Schutte, CTO · Sinan Calisir, Machine Learning Engineer 38