Zenus Bank selected NICE Actimize's cloud-delivered AML and Fraud Essentials before opening its planned international banking service, the vendor announced on September 10, 2019. The initial scope was specific: ACH, wire and debit-card fraud, alongside suspicious-activity monitoring, customer due diligence and watch-list filtering. It was a decision about how a new bank would assess accounts and payments, rather than a general statement that security mattered.
NICE Actimize said the service combined financial-crime analytics with a unified case manager. The bank was then expected to open in the fourth quarter of 2019. Selecting a cloud service before launch placed the planned account and payment controls alongside the development of the banking product.
A customer profile, a payment alert and an investigation do different work
Customer due diligence supplies context about the relationship. Transaction monitoring looks for unusual activity against relevant patterns and expectations. Screening checks names and payment information against applicable lists. Fraud controls examine the possibility of abuse in a transaction. A shared case environment is where those signals can become an investigation that a person can review and document.
Zenus's own account of the 2019 selection quoted chairman and founder Mushegh Tovmasyan linking financial-crime safeguards to the early development of its international service. For the bank, remote access and cross-border movement made the connection between customer information and payment activity part of the operating model.
Show data tableHide data table
| Function in the original scope | Question it helps investigate | Why the answer needs context |
|---|---|---|
| Customer due diligence | Who is the customer and what activity is expected? | A transaction may look unusual for one customer and ordinary for another. |
| Watch-list filtering | Does a person or payment require screening review? | A possible match needs an appropriate resolution process. |
| Suspicious-activity monitoring | Does activity depart from a relevant pattern or risk profile? | An alert identifies something to examine; it is not a conclusion that a crime occurred. |
| ACH, wire and debit-card fraud controls | Could a payment represent abuse or fraud? | The payment channel and customer behaviour affect how the event is interpreted. |
| Unified case management | What was investigated and how was it resolved? | Evidence and the reason for the decision must remain usable across the workflow. |
The functions above are drawn from the 2019 selection announcement; the questions explain the operating role of each function.
A later survey shows the range of payment exposure
The Federal Reserve's 2025 household survey provides independent context for monitoring across payment methods. Among adults who experienced non-credit-card fraud, debit cards and P2P services were the most frequently identified instruments. The frequency of an instrument appearing in the survey is influenced by its wider use, making this a view of customer exposure rather than a ranking of the intrinsic security of each rail.
Payment methods involved in non-credit-card fraud, US 2025
The Federal Reserve survey records which payment instruments affected adults said were involved.
%
Tap or hover for details. All values are also available in the data table.
Source
Among US adults who experienced non-credit-card-related fraud. Respondents could select multiple methods, so percentages do not sum to 100. Exposure also reflects payment-method use; these are not Zenus or Actimize outcomes.
Show data tableHide data table
| Category | Adults experiencing non-credit-card fraud |
|---|---|
| Debit card | 41% |
| P2P payment service | 29% |
| Bank wire / electronic transfer | 13% |
| Cryptocurrency | 9% |
| Prepaid / gift / benefit card | 7% |
| Cash | 6% |
| Personal check | 6% |
| Money transfer service | 4% |
| Cashier's check / money order | 3% |
| Other | 19% |
Supervisory guidance puts the decision process around the software
FFIEC's BSA/AML examination manual describes five interdependent parts of suspicious-activity monitoring and reporting: identification of unusual activity, alert management, the reporting decision, report completion and filing, and continued monitoring. It says the sophistication of the system should follow the institution's risk profile and that staff need adequate resources to research activity.
The manual also separates an automated signal from the decision about whether a suspicious-activity report is warranted. Investigators research the activity and document conclusions; a designated decision maker or committee has authority over the reporting decision. Software, investigation and accountability therefore belong to the same operating process.
That distinction is commercially useful for a fintech choosing infrastructure. Buying access to a bank's technology does not turn every generated alert into a confirmed loss, criminal finding or regulatory filing. The service depends on how information moves from detection to investigation and resolution, and on who is responsible for each decision.
Fresh 2026 evidence identifies the later ActOne environment
On July 1, 2026, NICE Actimize described Zenus's later cloud deployment of Suspicious Activity Monitoring, Customer Due Diligence, Watchlist Filtering and Fraud Monitoring on its ActOne platform. It said the bank was expanding that environment with InvestigateAI and NarrateAI. The fresh vendor account establishes the later relationship directly.
The vendor described the intended change at the start of an investigation: bringing customer records, transaction activity and related compliance information into the investigator's workflow. It also identified surveillance across ACH, Fedwire, SWIFT, card and stablecoin channels. Those are the channels described for the expanded 2026 environment.
The account emphasizes less manual information gathering and better retention of investigative context. Operationally, that changes the point at which the investigator begins: with related information brought together, the task can move toward assessing the activity and its significance. Retaining the context also gives a later reviewer a clearer record of what informed the decision.
Recovery changes the customer outcome
The same Federal Reserve survey distinguishes the amount initially lost from the amount remaining after recovery. Its medians show that frequency and financial severity ask different questions: a payment method can appear often in fraud experiences while the typical unrecovered amount differs from that associated with another method. That is useful context for connecting detection, investigation and customer resolution.
Median fraud losses before and after recovery, US 2025
Reported loss and the amount remaining after recovery differ by payment method.
USD
Tap or hover for details. Select a series above to show or hide it.
Source
Among US adults who lost money before recovery because of non-credit-card fraud. Source excludes five respondents reporting recovery above loss and one reporting a $5 million loss. Only sufficiently sampled methods are shown. A zero median does not mean everyone recovered all losses. Respondents could identify multiple methods, so loss and recovery estimates can reflect combinations of payment methods.
Show data tableHide data table
| Category | Before any recovery | After any recovery |
|---|---|---|
| Debit card | 300 USD | 0 USD |
| P2P payment service | 500 USD | 200 USD |
| Bank wire / electronic transfer | 2,000 USD | 100 USD |
| Cryptocurrency | 1,200 USD | 900 USD |
The bank adds its own risk engine around specialist tools
Zenus's current compliance page describes four layers: onboarding and due diligence, real-time risk scoring, transaction monitoring and API integration. It identifies a proprietary risk engine and places specialist partners, including NICE Actimize, within the broader system. The bank's account is of an assembled operating platform rather than one external product doing every job.
This matters as the business model changes. The bank's July 2025 strategy announcement focused on institutional and fintech infrastructure while planning an exit from its dedicated retail platform. A bank serving partner programmes has to relate activity at the institution, programme and end-customer levels. The quality of those connections influences how much useful context reaches the investigator.
Contemporary FinTech Futures reporting on September 11, 2019 records the original selection and its product scope. The later vendor account establishes a broader cloud platform, while FFIEC guidance explains the surrounding decision process. Neither the bank nor the vendor publishes a measured reduction in investigation time, false positives or headcount in these sources; the supervisory guidance is general context, not a rating of Zenus.
The practical connection across the two periods is the movement of information. The 2019 selection specified which account and payment risks the bank intended to assess. The 2026 tools seek to put more of the relevant evidence in front of the investigator. For partners depending on the bank's infrastructure, that connection between payment activity, customer context and accountable decisions is part of the service.
In this article
Daniel Brooks
Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.