TrustSphere Vendor Assessment: Delta Capita, What You Are Actually Buying When You Buy Capacity in 2026

Most financial crime buying decisions are decisions about software. A bank compares detection engines, examines model performance, argues about false positive rates and signs a licence. Delta Capita sits in a different part of the market, and the difference is more consequential than the procurement process usually recognises. What is on offer is not primarily a detection engine. It is a delivery organisation, wrapped in process and technology, that performs work the institution would otherwise perform itself.

The category is client lifecycle management and financial crime managed services: know your customer and know your business onboarding, periodic and event-driven refresh, remediation programmes for populations that have fallen out of policy, and the orchestration layer that sequences the tasks, holds the outstanding items and tracks a case from request to approval. Delta Capita's proposition combines consulting-adjacent design work with delivery capacity, and increasingly with mutualised utility arrangements in which several institutions consume a common process. Its buyers are typically institutions with a capacity problem and a process problem rather than a detection problem.

That makes this an awkward vendor to place in an index built to compare detection products, and the honest thing to say at the outset is that the index framework both flatters and penalises this vendor for the wrong reasons. This assessment therefore does two things: it reports the score and the capability profile in the usual way, and it then argues that a buyer relying on the profile alone will diligence the wrong things entirely.

Score and Capability Profile

Delta Capita scores 6.2 out of 10 on the TrustSphere RiskTech Index, against an index mean of 6.06. That places it marginally above the mean, in the client lifecycle and financial crime managed services category rather than in detection.

The capability breakdown is unusually spiky. Client Lifecycle Orchestration scores 8, the highest in the profile and the correct centre of gravity: case structure, outstanding item management, workflow across relationship management, operations and compliance, and the discipline of moving a file to a decision. eKYC and KYB scores 7, reflecting real depth in entity structures, ownership unwrapping, complex corporate and institutional clients and the document-heavy end of due diligence, which is where most of the delivery volume actually sits. Watchlist and Sanctions Screening scores 5 and Document Authentication scores 5: both are performed competently within the process, generally using third party components rather than proprietary technology, which is a sensible design choice and a limitation on how much credit it can earn in a product index. Identity Verification and Liveness scores 4 and Transaction Monitoring and Screening scores 4, present in the delivery scope but not where the differentiation lies. Fraud Detection scores 3, Enterprise Fraud Risk Management scores 2, Behavioural Biometrics scores 2 and Device Intelligence scores 2. These last four are effectively out of scope and should be read as such rather than as failures.

The shape says something the numbers do not. A profile with 8 at one end and 2 at the other, in a vendor whose value proposition is a delivery organisation, is telling you that the index is measuring the wrong dimension. The score of 6.2 is defensible, but it is largely a statement about coverage of a technology taxonomy, and coverage of a technology taxonomy is not what determines whether this arrangement succeeds. What determines that is whether the people are good, whether they stay, where they sit, whether the quality framework is honest, and what the commercial construct rewards. None of those are index categories, and all of them matter more here than any capability score in the list.

What It Actually Does Well

The genuine strength is complex entity due diligence performed at volume by people who do it every day. Unwrapping an ownership chain across several jurisdictions, resolving a trust structure, identifying and evidencing controlling persons in a fund of funds, and doing it consistently across thousands of files is a craft skill rather than a technology problem, and institutions are persistently bad at retaining the people who have it. A supplier whose entire business is that craft has a structural advantage over a bank whose analysts rotate out within eighteen months, and in the engagements we have reviewed this shows up most clearly on institutional and corporate populations rather than retail.

The second strength is process design that survives audit. Remediation programmes fail in predictable ways: an unclear population definition, a policy interpretation that shifts halfway through, evidence standards that vary by analyst, and a completion claim that does not withstand challenge. A supplier that has run the same programme shape repeatedly brings a defensible file standard, a documented interpretation, a quality assurance regime and a completion report designed to be read by a regulator. For an institution facing a supervisory commitment with a date attached, that repeatability is frequently worth more than any individual efficiency claim.

The third strength is the mutualised model, where it fits. Performing the same due diligence on the same large counterparty separately at ten institutions is obviously wasteful, and utility arrangements that assemble and maintain a file once, to a standard several institutions accept, address a real cost problem in wholesale and capital markets onboarding. This works better in institutional segments with heavy overlap than in retail, and it works only where the participating institutions will genuinely accept a common standard rather than layering their own exceptions on top, which is where most such initiatives quietly fail.

Where the Limitations Are

The first limitation is the pricing incentive, and it applies to the category rather than to this supplier specifically. Where the commercial model is per file, per case or per alert, the supplier's revenue rises with the volume and the complexity of the work, and falls if the institution simplifies its policy, raises its risk-based thresholds or automates a step. The organisation best placed to observe that a refresh policy is generating thousands of low-value files is the organisation being paid to complete them. That is not an accusation; it is a description of the contract. Unless the construct contains a fixed fee element, a productivity commitment or a gainshare on volume reduction, the buyer should expect the process to be executed well and never to shrink.

The second limitation is that quality is genuinely hard to benchmark. Detection products can be compared on a common historical population; a delivery organisation cannot. The quality framework is the supplier's, the sampling is largely the supplier's, the pass criteria are negotiated, and the reported quality rate is therefore a measure of conformance to an agreed standard rather than of whether the right risk decision was made. Two suppliers reporting materially similar quality scores may be operating to very different evidential thresholds. The only reliable comparison we have seen work is a blind re-review of a sample of completed files by an independent party against the institution's own policy, and it is very rarely commissioned before contract.

The third limitation is dependency and exit. These arrangements accumulate institutional knowledge in the supplier: the policy interpretations, the edge cases, the escalation conventions, the reasons a particular population was scoped as it was. Three years in, the institution's own understanding of its onboarding process is frequently thinner than the supplier's, the run book lives on the supplier's side, and the retained team has become a contract management function rather than an operational one. Exit plans written on the assumption of a clean transfer to another provider tend not to account for that, and a repapering exercise carried out during a transition is the point at which the weaknesses in file standards become visible.

The fourth limitation is concentration, and it is specific to a supplier that advises as well as delivers. Where the same organisation designs the target operating model, defines the process, executes the work, sets the quality framework and reports on its own performance, the institution has removed the independent challenge from every stage of the chain. This is not a reason to avoid the supplier, but it is a reason to keep the design authority, the policy interpretation and the assurance function separate and internal, and to be sceptical of a recommendation that the answer to an operating model problem is more of the recommending party's delivery capacity.

Questions to Press in the Demo

There is not much to demonstrate here in the conventional sense, and a buyer who spends the session watching a workflow screen has wasted it. The subject is the delivery organisation, and the questions should be aimed at things a slide cannot answer.

• Show us the attrition rate on the delivery teams that would serve us, by location and by tenure band, for the last three years, and tell us what proportion of the named individuals in this room would still be on our account after twelve months.

• Take a completed file from a comparable client, redacted, and walk us through the quality assurance record: who reviewed it, against what criteria, what failed, what was remediated, and who decided it had passed.

• Describe exactly where our customer data would be processed and stored, which entities in your group and which sub-contractors would have access, and how our audit and access rights would be exercised in each of those locations.

• If we reduce our refresh population by a third through better risk-based segmentation, what happens to your revenue, and what in this contract gives you a reason to help us do it?

• Set out what we would need to have retained internally to take this process back in twelve months, and tell us honestly what our clients have found missing when they have tried.

Verdict

Delta Capita is a sound choice for an institution with a defined capacity and process problem in client lifecycle management, particularly in corporate, institutional and capital markets segments where entity complexity is high and the internal bench is thin. It is a good choice for a remediation programme with a supervisory commitment attached, where repeatable process and a defensible completion report matter more than unit cost. The 6.2 is earned in the categories that describe what it does and depressed by categories that describe what it has never claimed to do.

It is the wrong purchase for an institution looking for detection capability, for anything on the fraud side of the house, or for a buyer hoping that engaging a supplier will transfer the obligation, which it does not. It pairs with a screening and monitoring estate the institution owns, a case management platform the institution controls, and, most importantly, a retained internal design authority that keeps policy interpretation and quality assurance out of the supplier's hands. Buy the capacity, keep the judgement.

Suggested Next Steps

• Diligence the delivery organisation rather than the product: attrition, tenure, location strategy, sub-contracting chain and named team continuity, evidenced with data rather than described in a proposal.

• Commission an independent blind re-review of a sample of completed files against your own policy before contract, and repeat it periodically as an assurance control rather than relying on supplier-reported quality rates.

• Build a commercial construct that rewards volume reduction and automation, with a fixed fee element or productivity commitment, so that simplifying your own policy is not a loss to your supplier.

• Keep design authority, policy interpretation and quality assurance internal and separate from the delivery contract, and define a retained capability floor sufficient to bring the process back.

Sources: European Banking Authority guidelines on outsourcing arrangements and on internal governance; Financial Conduct Authority and Prudential Regulation Authority policy on operational resilience and important business services; Digital Operational Resilience Act requirements on third party arrangements; Financial Conduct Authority financial crime guide and Senior Managers and Certification Regime obligations; Joint Money Laundering Steering Group guidance on customer due diligence and ongoing monitoring; Wolfsberg Group guidance on correspondent banking and on effectiveness; Financial Action Task Force standards on beneficial ownership; General Data Protection Regulation provisions on processors and international transfers; TrustSphere Risk Index, April 2026.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai