Fintech & Digital Assets
PCI DSS v4: what changed for merchants and acquirers
The requirements that were "best practice" until March 2025 are now mandatory. Most of them land on payment pages, authentication and the way risk is documented.
Company profile
Four practices, twelve commodity desks and every service line in one document. Read it online or download the PDF.
Rule-based monitoring floods compliance teams with alerts that turn out to be nothing. Machine learning can cut the noise, as long as decisions stay explainable and accountable.

Every bank, exchange house and payment provider runs transaction monitoring to detect money laundering and terrorist financing. Most still rely mainly on rules: a transfer above a threshold, too many cash deposits in a week, a payment to a high-risk country. Rules are easy to explain, but they generate many alerts, and in most programmes the large majority turn out to be false positives.
Machine learning does not replace the decision to file a suspicious transaction report. That remains a human judgement, made by a trained officer who can explain it. A model also cannot fix poor data: if customer risk ratings, occupations or transaction purposes are missing or wrong, the model will learn the gaps.
Supervisors, and FATF guidance on new technologies, are broadly supportive of advanced analytics, but they expect:
The safest path is to run models alongside existing rules, compare outcomes over several months, and only then let scores change how alerts are handled. Our fintech team builds monitoring and screening platforms with this approach, and keeps every model decision traceable for audit.

Fintech & Digital Assets
The requirements that were "best practice" until March 2025 are now mandatory. Most of them land on payment pages, authentication and the way risk is documented.

Fintech & Digital Assets
Cross-border payment messages have moved to ISO 20022. The richer data only helps if it is captured correctly at the counter and in the app.

Fintech & Digital Assets
Losses at exchanges and custodians rarely come from broken cryptography. They come from weak controls around keys, approvals and withdrawals.
Tell us the product or service, the quantity or scope, and your timeline. We reply within one business day.