TrustSphere Vendor Assessment: Cable, (now acquired by Synctera). Continuous Control Testing That Proves Effectiveness But Stops Nothing

Almost every financial crime control failure that reaches a public outcome has the same shape. The control existed. It was documented, approved, on the control register, and tested annually against a sample of twenty five cases that all passed. Somewhere between the policy and the production system it stopped firing for a population it was supposed to cover, and nobody found out for eighteen months, because sampling is not built to find that.

This is the gap Cable exists in. Its proposition is automated, continuous testing of financial crime controls against the full population of accounts, customers and transactions rather than a periodic sample, producing an evidenced answer to the question a supervisor actually asks: not whether you have a control, but whether it operated as described, on every case it should have covered, throughout the period. The company grew up in the fintech and banking-as-a-service estate, where sponsor banks needed a way to see whether programme partners were genuinely running the controls their agreements required, and it has a strong following in that segment.

The category is legitimate and under-served, and the assessment that follows is nonetheless sceptical. Assurance technology tends to be sold as though it were detection technology, and the distance between demonstrating that a control fired and stopping a payment is the distance between the second line and the first.

Score and Capability Profile

Cable scores 6.2 out of 10 in the TrustSphere RiskTech Index, against an index mean of 6.06, in the category of financial crime control testing and assurance. That is marginally above the mean, the right answer for a product that does one genuinely differentiated thing very well and deliberately does not attempt most of what a financial crime platform does.

Taking the fifteen capability lines in order, with the standard index lines retained whether or not the vendor addresses them. Automated control testing across the full population scores 8, the core of the product and the reason to look at it. Control inventory modelling and test library scores 7. Regulator-facing and audit-facing evidence output scores 8. Sponsor bank oversight of programme partners scores 8. Deployment speed and time to first result scores 8. Data ingestion and connector coverage scores 6. AML and onboarding control coverage scores 7. Real-time payment fraud control coverage scores 4. Detection and interdiction, meaning whether the product prevents anything in flight, scores 2. Findings triage, workflow and remediation management scores 5. Tier 1 scale and legacy data estate fit scores 4. On the standard lines, transaction monitoring and screening scores 3, enterprise fraud risk management scores 4, the combined behavioural biometrics, device intelligence, identity verification and liveness and document authentication line scores 2, and the combined eKYC, KYB and client lifecycle orchestration line scores 3.

The weighting vector is published so the arithmetic can be checked. Automated control testing across the full population carries 17 percent, control inventory modelling and test library 11 percent, regulator-facing and audit-facing evidence 10 percent, sponsor bank oversight of programme partners 9 percent, deployment speed 7 percent, AML and onboarding control coverage 7 percent, real-time payment fraud control coverage 6 percent, findings triage and remediation management 6 percent, data ingestion and connector coverage 5 percent, detection and interdiction 5 percent, tier 1 scale and legacy estate fit 5 percent, and 3 percent each to transaction monitoring and screening, enterprise fraud risk management, the combined biometrics, device, identity and document line, and the combined eKYC, KYB and lifecycle line. Those fifteen weights sum to 1.00 and, applied to the scores above, produce a composite of exactly 6.20.

The unweighted mean of the same fifteen scores is about 5.3, so the weighting is already generous, concentrating just under half the weight on the four lines where the product is strongest. It still clears the index mean only slightly, and the reason is visible in the shape: a tall peak on population testing and evidence production, a shallow shoulder across coverage and workflow, and a floor on everything that touches prevention. That is not a criticism of the build. It is a statement that this is an assurance product and should be bought as one.

What It Actually Does Well

The differentiated strength is population testing. Traditional control testing selects a sample, reperforms the control on those cases and extrapolates. That method detects a control that is wrong in design and misses one that is right in design and intermittently absent in operation: the rule disabled during a release and never re-enabled, the screening job that silently failed for a subset of a file, the due diligence step a workflow exception routed around, the risk rating that never recalculated for customers onboarded through one channel. Those failures are population-shaped, not sample-shaped, and Cable finds them because it asks the question of every case rather than of twenty five.

The second strength is the form of the output. A supervisor, a skilled person or an internal audit function does not want an assertion that controls are effective; it wants evidence of coverage, exceptions, timing and remediation. Producing that manually is a substantial recurring cost, and firms in remediation typically find the reporting effort consumes more capacity than the fixing does. Continuous, dated, population-level evidence converts directly into supervisory engagement and audit closure.

The third strength is oversight across an entity boundary. A sponsor bank carrying regulatory responsibility for the financial crime controls of embedded finance programmes and agent partners has historically had two options: trust the partner's attestation, or send people. Neither scales, and the enforcement record in this segment shows what happens when oversight is nominal. An instrumented, continuous view of whether a partner's controls actually operated is the most useful thing in the proposition, and it explains the following the product has among banking-as-a-service providers and their sponsors. It also stands up quickly, with first meaningful results in weeks rather than quarters.

Where the Limitations Are

The first limitation is the one to internalise before anything else: this is assurance, not detection. Cable tells you that a control did not fire. It does not stop a payment, hold an account, block an onboarding or interdict anything in flight. The finding arrives after the event and its value is entirely in remediation and evidence. Institutions under board pressure occasionally buy an assurance tool and count it as a control improvement. It is not one. It is a measurement of control improvement, which is valuable and different, and presenting it otherwise will not survive challenge from a competent non-executive.

The second limitation is that the output is only as good as two inputs, both the buyer's responsibility. The first is the control inventory: the product tests what you tell it to test, expressed as assertions. Firms with a vague register full of statements like "customer risk is assessed appropriately" will find the first three months are a control articulation exercise rather than a testing exercise, and that this work cannot be outsourced to the vendor because it requires judgement about what the control is meant to achieve. The second is data. Coverage is bounded by the feeds available, and a control operating in an unconnected system is untested while appearing on a dashboard that implies completeness. A green dashboard over an unconnected system is more dangerous than no dashboard at all.

The third limitation is coverage shape. Cable's strongest ground is onboarding, customer due diligence, risk rating, screening operation and AML process controls, where assertions are discrete, timing is clear and the population is well defined. Real-time payment fraud is a harder fit. Fraud controls are probabilistic rather than binary, the relevant question concerns score distributions, threshold drift and model decay rather than whether a rule executed, and the evidence a fraud function needs looks like a model monitoring pack. Buyers whose principal pain is authorised push payment or card fraud effectiveness are buying into the weaker half of the product.

The fourth limitation is fit at scale. The product was built in and for the fintech estate: modern data platforms, comparatively clean event streams, few systems, a single jurisdiction and a control environment young enough to be documented coherently. A tier 1 bank with three decades of accumulated core systems, regional variations of the same nominal control and customer data spread across acquisitions presents a much harder integration and control mapping problem. Related to this is the capacity trap. A tool that tests the full population surfaces findings at a volume no second line function has had to absorb, and without a materiality threshold and a remediation pipeline agreed before go-live, the institution acquires a documented, dated, undeniable backlog of control failures it has not fixed. That is a worse regulatory position than not knowing, and it is the commonest way this class of product goes wrong.

Questions to Press in the Demo

Move off the dashboard tour and onto the four things that decide whether this works in your institution: whether your control inventory is testable, whether your data reaches the tool, what happens to the findings, and what the product genuinely does with probabilistic fraud controls.

• Take three controls from our actual control register, verbatim and unedited, and convert them in front of us into testable assertions, then tell us honestly which of the three cannot be tested as written and why.

• Show us a real example, with the customer anonymised, where your testing found a control that had silently stopped operating for a subset of the population, and tell us how long it had been failing before you found it.

• Our payment fraud controls are score-based, not binary. Demonstrate what you would actually test there, and be explicit about what you cannot test and where we would still need separate model monitoring.

• Name the systems you would need feeds from to reach the coverage you have just shown us, tell us what the dashboard displays for a control whose source system is not connected, and show us that state on screen.

• Give us the findings volume a comparable institution generated in the first ninety days, how many were material, how many were closed within the period, and what the vendor does when the remediation queue grows faster than the client can work it.

  
  

Verdict

Cable is a sound buy for a fintech, an electronic money institution, a banking-as-a-service provider or a sponsor bank that needs continuous, evidenced assurance over a control environment it can articulate, and particularly for a sponsor bank seeking genuine oversight of programme partners rather than attestation. It also fits a firm in remediation, where the recurring cost of producing control evidence manually is the binding constraint. Bought for those purposes, with a control inventory worth testing and a second line with capacity to act, it earns its place.

It should not be bought as a detection capability, as a substitute for transaction monitoring or fraud scoring, or by an institution whose control register is not yet testable, because the tool will faithfully test vagueness and report it as coverage. Tier 1 buyers with fragmented legacy estates should prove a bounded domain before committing to enterprise rollout. It pairs with a platform that owns detection, a model monitoring capability covering the probabilistic controls it cannot test, and an issue management process able to absorb what it finds. At 6.2 the index is saying something specific: a well-built product in a useful category, where most of the value depends on work the buyer has to do first.

Suggested Next Steps

• Audit your own control register for testability before approaching any assurance vendor, rewriting a representative sample of controls as assertions with a defined population, a defined expected outcome and a defined timing, and treat the proportion you cannot express that way as the real readiness score.

• Map the data feeds required to test your priority controls, identify which source systems are not accessible, and agree in advance how untested controls will be displayed so that an incomplete dashboard cannot read as a complete one.

• Agree the findings pipeline before go-live: materiality thresholds, triage ownership, service levels for remediation, and what happens to the queue if volumes exceed second line capacity.

• Scope the first phase to onboarding, due diligence and screening controls where the product is strongest, and keep payment fraud effectiveness under a separate model monitoring workstream rather than assuming the assurance tool will cover it.

Sources: Financial Conduct Authority, Prudential Regulation Authority, EBA, Wolfsberg Group, Payment Systems Regulator, HM Treasury, DORA, TrustSphere Risk Index, April 2026.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai