TrustSphere Vendor Assessment: SentiLink, a Narrow Instrument Pointed at the Right Target

Hero image: application-decision-screen-identity-risk-score-2028.jpg. A close crop of a lending decision screen showing an anonymised application record and a scoring panel, the rest of the office out of focus.

Most identity verification exists to answer a question that synthetic identity fraud does not ask. The conventional stack confirms that the person in front of you is the person the document describes, that the document is genuine, that the face is live, and that the credential has not been stolen. Applied to a synthetic identity, every one of those checks can pass, because there is no stolen credential and no impersonated victim. The applicant is not pretending to be somebody else. The applicant is not anybody.

That is why the category exists as a separate purchase. Detecting a constructed identity is not a verification problem, it is an inference problem: does this combination of identifier, name, date of birth, address and contact details behave, across the identity data ecosystem and over time, the way a real person's combination behaves? It requires visibility across a large population of applications, a view of how identity elements have historically appeared together, and an analytical layer that can distinguish a genuine thin file from a manufactured one. Almost no institution can build that alone, because almost none sees enough of the population.

SentiLink is one of the few vendors whose proposition is squarely that problem rather than identity verification generally. It scores applications for synthetic identity risk and for first-party fraud risk, returns reason codes intended to explain the score, and supports the models with an internal identity intelligence and analyst function that investigates emerging construction patterns rather than relying on automated retraining alone. The assessment below takes that focus seriously, which means being clear about how narrow it is and what the buyer still has to do.

Score and Capability Profile

SentiLink scores 6.31 out of 10 in the TrustSphere RiskTech Index, against an index mean of 6.06, in the category of identity risk and synthetic identity detection at the credit application decision point. That places it above the mean, but the composite is a poor summary and the shape underneath it is the whole story.

Taking the capability lines in order, retaining the standard index lines alongside the extensions this proposition requires: synthetic identity detection, an extension line added because it is the central claim rather than a feature, scores 9. First-party fraud and abuse scoring, a second extension line, scores 8. Explainability and reason code quality, a third extension line, scores 8. Fraud detection scores 7. Identity verification and liveness scores 6. eKYC and KYB scores 5. In-life and portfolio monitoring, a fourth extension line, scores 4. Geographic coverage outside the United States identity data ecosystem, a fifth extension line, scores 3. Device intelligence scores 3. Document authentication scores 3. Enterprise fraud risk management scores 3. Client lifecycle orchestration scores 3. Alert workflow, case management and investigation scores 3. Transaction monitoring and screening scores 2. Watchlist and sanctions screening scores 2. Behavioural biometrics scores 2.

The weighting vector is published so the arithmetic can be checked. Synthetic identity detection carries 20 percent, first-party fraud and abuse scoring 15 percent, explainability and reason code quality 11 percent, fraud detection 10 percent, identity verification and liveness 9 percent, eKYC and KYB 6 percent, in-life and portfolio monitoring 5 percent, geographic coverage outside the United States 5 percent, device intelligence 4 percent, document authentication 3 percent, enterprise fraud risk management 3 percent, client lifecycle orchestration 3 percent, alert workflow and case management 3 percent, transaction monitoring and screening 1 percent, watchlist and sanctions screening 1 percent and behavioural biometrics 1 percent. Those sixteen weights sum to 1.00 and, applied to the scores above, produce a composite of exactly 6.31.

The unweighted mean of the same sixteen scores is 4.44, so the weighting lifts the product by almost two points. That gap is not a criticism, it is a description. This is a specialist instrument with three high scores, a competent middle and a long tail of lines it does not seriously address. A buyer who needs one thing done properly will find the composite understates it. A buyer hoping to consolidate several controls into one contract will find it flatters, because ten of these sixteen lines score 3 or below and must be bought elsewhere.

What It Actually Does Well

The genuine differentiation is that the product was designed around synthetic identity rather than having synthetic identity added to an identity verification roadmap. That distinction shows up in the failure modes. Generic verification asks whether the credential is valid and whether the person is present; a synthetic passes both. A purpose built model asks instead whether the identity elements have a history consistent with a real life, whether the combination has appeared before in ways a real combination would not, and whether the file is thickening in a manufactured pattern. In the portfolios we have reviewed, that is the question that actually separates the population, and very few vendors answer it.

The second strength is the placement. Scoring at the credit application decision point is the highest leverage position available for this risk, because it is the last moment at which the institution can decline without cost. Once the account is opened, the operator's patience becomes the institution's problem for as long as the identity chooses to behave well. Intake reduction does not solve the risk, but it is the cheapest component of the answer, and a vendor that scores accurately there buys the institution years of avoided loss it will never measure precisely.

The third strength is explainability, and it matters more here than in most fraud categories because the consumer is a credit applicant rather than a payment. Reason codes that a credit risk team can read, debate and translate into policy are the difference between a score that changes decisions and a score that sits in a data warehouse. Credit functions are accustomed to scorecards, reason codes and challenge from model risk governance. A synthetic identity score that arrives with an intelligible explanation fits that operating model. One that arrives as an opaque number does not, and will be overridden quietly until it is switched off.

Where the Limitations Are

The first limitation is geography, and for most readers of this assessment it is the decisive one. The proposition is built on the United States identity data ecosystem, with its particular identifier structure, bureau architecture, application data conventions and the specific construction techniques that ecosystem invites. None of that transfers automatically. A United Kingdom or European buyer should assume nothing about coverage, match rates or lift outside that market and should require evidence on their own data before any commercial conversation. This is not a criticism of the vendor, which has never claimed to be a global identity platform. It is a warning against buying a model whose training population does not resemble your book.

The second limitation is that this is an application time control and does not, on its own, address in-life bust-out. The operator who ages an identity for three years and monetises it in the fourth was scored correctly or incorrectly at origination and will not be scored again. Nothing in an application scoring product watches the maturing cohort or detects the burst of credit seeking across institutions that precedes a drawdown. The institution still has to build portfolio and in-life monitoring, and should plan for it in the same business case rather than discovering it in year two.

The third limitation is category breadth, and the profile above states it plainly. This is not transaction monitoring, it is not sanctions or watchlist screening, it is not a case management or investigation platform, and it is not a client lifecycle orchestration layer, a document authentication tool or a device intelligence source. Any procurement that lists this vendor alongside enterprise platforms is comparing objects of different kinds, and the shortlist has been mis-specified before the demonstrations begin.

The fourth limitation is dependency, in two forms. Commercially, the proposition rests on continuing access to bureau and identity data relationships, and the buyer should understand what happens to coverage and to price if one of those relationships changes. Operationally, the harder dependency sits with the buyer: the vendor can tell you that an application carries elevated synthetic risk, but it cannot tell you what your credit policy should do about it. Declining outright, granting with a capped limit, suppressing automatic limit increases, referring to manual review or accepting and monitoring are all defensible, and the choice has revenue, loss, fairness and Consumer Duty consequences that belong to the institution. A score with no policy attached to it changes nothing. That is a governance problem no vendor can solve, and the commonest reason these purchases underperform.

Questions to Press in the Demo

Keep the conversation away from the case studies and onto the three things that decide whether this works for you: whether the model performs on your population rather than the vendor's, what it does not cover, and what your own policy will do with the output. Every question below should be answered with your data or with a named reference, not with a slide.

• Run the model retrospectively against twenty four months of our own application and performance data, including accounts that charged off, and show us the separation achieved on our book, the capture rate at the decline threshold we would actually operate, and the false positive burden on genuine thin file applicants.

• Evidence your coverage and performance outside the United States identity data ecosystem for the specific markets in our footprint, naming the data sources behind it, the match rate we should expect, and at least one client of comparable profile in that market who will speak to us.

• Take three reason codes from a live score and explain to our credit risk and model risk teams exactly what drove each one, at a level of detail that would survive internal model validation and a supervisory question about how the decision was reached.

• Show us what your product does not do in our target state architecture by walking through a single synthetic identity from application through three years of good conduct to bust-out, and marking explicitly every point on that timeline where you contribute nothing and we need another control.

• Tell us how your models are retrained and how your analyst team feeds new construction patterns into production, how long it takes from a pattern first being observed to being reflected in the score we receive, and how we are notified when scoring behaviour changes materially.

Verdict

Buy SentiLink if you are a United States lender, card issuer, deposit taker or fintech with a genuine synthetic identity and first-party fraud problem at origination, and if you have or are building the credit policy machinery to act on a score. For that buyer this is a strong, focused purchase and 6.31 understates it, because the index rewards breadth this buyer does not need and penalises a specialist for being one. Buy it with the retrospective validation completed on your own data, with the threshold policy written before go live, and with a named owner for the decision rules the score will drive.

Do not buy it as a general identity verification platform, as a replacement for document and liveness checking, or as any part of an anti-money laundering control stack. Approach it with scepticism, and with an evidence requirement, if your book sits outside the United States, because the identity data ecosystem it was built for does not exist in the same shape elsewhere. It pairs with a document authentication and liveness specialist for remote onboarding, with device and behavioural signals where account takeover is the adjacent risk, with a case management layer if referred applications need investigation, and above all with an in-life portfolio monitoring capability that watches the cohort it approved.

Suggested Next Steps

• Run a retrospective validation on twenty four months of your own application and performance data before any commercial discussion, and treat separation on your book and the false positive burden on genuine thin file applicants, rather than the vendor's published performance, as the decisive evidence.

• Write the credit policy response to the score before implementation, stating at each threshold whether the outcome is decline, capped limit, suppressed automatic limit increase, manual referral or accept and monitor, and record the fairness and Consumer Duty analysis supporting each.

• If any part of the target book sits outside the United States, require documented evidence of data coverage, match rates and model lift for those specific markets, together with a reference client of comparable profile, and make contract signature conditional on it.

• Budget and plan the in-life portfolio monitoring capability in the same business case, covering cohort maturation analysis, cross-institution credit seeking bursts and synchronised utilisation movement, so that application scoring is not mistaken for a complete answer.

Sources: Cifas National Fraud Database and annual analysis of first-party and application fraud; UK Finance reporting on application and identity fraud; Federal Reserve payments fraud insights on the definition, detection and mitigation of synthetic identity fraud; Federal Bureau of Investigation Internet Crime Complaint Centre annual reporting on identity based schemes; Financial Conduct Authority Financial Crime Guide, expectations on systems and controls, and Consumer Duty outcomes for credit customers; Payment Systems Regulator authorised push payment reimbursement requirements and their treatment of claims where the payer is party to the fraud; European Banking Authority guidelines on outsourcing arrangements and on the use of remote customer onboarding solutions; Digital Operational Resilience Act requirements for third party risk management; Basel Committee operational risk framework treatment of fraud loss events; TrustSphere Risk Index, April 2026.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai