Making KYC and AML frictionless with AI - Krik Gunning, CEO and co-founder of Fourthline (the Netherlands)

Speaker A: Foreign. Voice of fintech.

Speaker B: Welcome to Voice of Fintech, a podcast mapping out the Swiss and global fintech scene. Connecting fintech enthusiasts with startups, incubators, accelerators, business angels and VCs, and incumbents interested in partnerships. Voice of Fintech will help you navigate the fintech ecosystem. Here you can listen to the startup founder stories, what investors and incumbents are looking for when dealing with startups, and find out more about resources provided by incubators and accelerators. My name is Rudy Falad and I'll be hosting this podcast.

Speaker A: Hello and welcome to Voice of fintech. Today we're going to talk to Crick from fourthline. We're going to talk about anti fraud solutions and KYC Solutions and why FourthLine is better than anybody else. Let's see if that's true. Up to you and up, um, to Crick to explain. So thank you so much for joining us. How are you today?

Speaker C: I'm doing very well and thanks so much for having us. Really looking forward to our conversation.

Speaker A: Brilliant. So can you tell us a little bit about yourself? How did you get to do what you do today and also where are you based?

Speaker C: Right, yeah. So I'll give you a quick personal background. I was actually born in Alexandria, Virginia in the us Then moved to England, then to Belgium, spent the majority of my childhood in the Netherlands, spent a gap year in Spain, stint in Beirut in Lebanon, and I am now based in Amsterdam, the Netherlands, where I'm proudly leading a team of 250 people with 50 different nationalities.

Speaker A: Wow. All right, so but what brought you to become an entrepreneur? Right. You could do 10 million different things as well in life, so why starting your own business?

Speaker C: Well, Rudolf, just like you, actually started my career in investment banking on the MA advisory side. I then left, co founded an advisory boutique that was partially doing M and A and partially advising startups that were looking to raise capital. And back in 2013, 2014, you saw a lot of activity popping up in fintech. Uh, and at some point in time I realized that I didn't just want to be an advisor telling other people what to do. I really wanted to jump in and be part of the movement.

Speaker A: I see. All right, well, great stuff, great stuff. Now, we talked about fourthline. So what is fourthline? Maybe let's also explain the name. Right, there typically is some sort of a story behind it. Or did you just hire some consultants to find out the name that sounds best?

Speaker C: No, absolutely not. And I think it's good to tell a little bit of the origin of the business because back in 2015, I joined another fintech called SafeNet, and we built and launched a deposit platform. And in order to get that up and running, we needed two things. First, we needed to be regulated as a financial institution. And we obtained a payment institution license initially in London, and following Brexit, we obtained it from the Dutch central bank in Amsterdam, the Netherlands. And the second thing we needed to solve was the challenge around kyc. We were obliged to meet our regulatory obligations and need to run full checks on, um, veto clients. And back then, this was 2015, we evaluated the technology solutions that were available to solve this. And we very quickly concluded that the only way to use existing technology would be to implement six different point solutions. Because as a regulated financial institution, it's not just about snapping a picture of an ID document. You actually need to run a lot of checks on individuals. And implementing six different point solutions that didn't speak to each other in the back end didn't seem like a very elegant solution. And back in 2016, we made a bold bet and decided that we thought we could do a better job ourselves by building a platform from scratch, leveraging AI from day one, which was pretty unique back then, and making sure that we had all the proprietary technology in house. And once the platform was up and running, towards the end of 2017, we were approached by a number of fintechs who essentially asked, can we use your platform and as a standalone, um, solution. And it turned out that the pain that we had solved for ourselves is a pain that many other fintechs and banks face as well. And we initially launched the product under the SafeNet brand, but it started growing very rapidly. And in 2019, we decided to split the two companies and rebrand the identity platform to Fordline. Now, why Fordline? That's because banks traditionally have a three lines of defense model against financial crime. First line being the business, second line being compliance, third line being internal audit. And we believe that in a mobile first era where AI plays such a fundamental role, banks and FinTechs need a fourth line of defense, hence the name.

Speaker A: I see, I see. Yeah, yeah, yeah. That brings me back to controls, uh, days. Okay, so fourth line, fourth line of defense. Okay. And you said something about six points in the background. What was that? That didn't speak to each other. What were the examples of the six points you were, uh, mentioning?

Speaker C: Yeah, I think it's good to elaborate a little bit on what people actually mean when they use the term kyc. And it's in practice something that varies wildly depending on the Use case and what we see, if you look at one end of the spectrum, let's say you want to rent an electric scooter and the company requests you to take a picture of your driving license and a selfie, making sure that they actually know who will be riding the scooter. I think on that end of the spectrum a basic check is sufficient. Why? Worst case, the company loses a scooter, but that's manageable for them. If you look at the other end of the spectrum, with highly regulated companies like banks and fintechs, there's actually much more at stake. As society, we've chosen to essentially outsource a very fundamental part of uh, society which is making sure that crime doesn't pay off to commercial organizations like banks. And we've told them that they need to be effective gatekeepers to the financial system. And to make sure they do so, we've imposed very strict regulations on them, both from a privacy perspective as well as from an anti money laundering perspective. And that means that in practice, banks need to run way more checks than the scooter company that I gave in the example. And that means you need to do checks on biometrics, you need to do checks on documents, you need to do checks on address, you need to do checks on device, you need to make sure that people are not on a sanctionist, they're not a politically exposed person, they haven't been involved in adverse media. You need to calculate a risk score, you need to have an auditory of everything that you've been doing. And we concluded back then that none of the existing technology could solve for that problem because, uh, each solution would be a piece of the puzzle, but not the entire puzzle. And that's really where Fourth Line took a different approach. We are a regulated financial institution and we built something that has an incredible fit with the needs of financial institutions today.

Speaker A: All right, so you're saying you're leveraging AI as well to do kyc? The KYC can be quite complicated depending on the. There are fragmented solutions out there. And you came up with something else. So how does this work? Uh, maybe let's explain in plain English, how does fourthline work?

Speaker C: So what we've built is a cloud native microservice architecture. And what that means in plain terms is we've built small building blocks and you can pick and choose what is relevant to you depending on um, the geography where you operate. If you look especially at Europe, there's a lot of fragmentation in the regulatory landscape in Europe. And we have all the Building blocks to make sure that you can comply with the local regulations. Whether it's in the Netherlands, in France where you need a uh, qualified E trunk signature, in Spain where you have additional liveness requirements, we have all of these building blocks for you. Which means that you can impose just the right amount of friction to on the one hand make sure that you block the bad actors. But more importantly, and I think that's the bigger theme, how can I make sure that you as a bank client can actually protect your identity, your account, your savings? By not just running checks at the moment of onboarding, but also offering tools that on uh, a continuous basis can check whether the person using the account is actually the same as the person that holds the account. Making sure that there's no account takeover, that no one is trying to get access to your savings.

Speaker A: So maybe that leads me to a follow up question. I mean are you a B2B business, you're selling your solution to banks or also to other types of stakeholders in the financial system?

Speaker C: So we're predominantly B2B2C which means our clients tend to be on one hand large fintechs including Revolut, Trade, Republic, Conto, on the other hand, large traditional financial institutions like NN and Rabobank. And in the end what we want to make sure is that we serve the needs of both these financial institutions which want to make sure that they comply with the regulations, that want to make sure that they can actually grow in the geographies that are important to them, but that we also serve the end customer. The end customer in the end expects a really smooth onboarding process. And if I go back to the days when I opened my first bank account myself, I physically walked into a bank branch, I showed my passport to the bank director and I got a cup of coffee in a bank account. And that has changed. In the mobile first era today people expect to be able to open a bank account from anywhere, anytime, any device and get a response in near real time. That means that you need to have a solution that can satisfy the needs both from the risk and compliance teams at the banks that want to make sure that they don't get into trouble with the regulator. And on the other hand with this super demanding client that expects to have a really smooth onboarding process and be able to use their account as quickly as possible.

Speaker A: Absolutely. And by the way, you are lucky if you got a coffee, right? I didn't get a coffee and they opened an account on the fourth attempt. Okay. Because I continuously signed it outside of the box. Or what have you. Right. I also heard cases where the relationship manager went to a, uh, person's house because it was a high net worth individual and still got the address wrong. Okay. So they couldn't open.

Speaker C: But uh, I think actually will, your experience is the way a lot of people view this. Right. And I think that's where the big opportunity is in this industry. If you ask a bank or if you ask a bank client like yourself and what they think of kyc, then almost always people will say it's a painful process. And while I understand that from one aspect, I think people don't realize that it's also, with the technology that is in place today, a fantastic opportunity. It's actually an opportunity for you to properly identify yourself to the bank and provide a ground truth that later on can be leveraged to make sure that no one else gets access to your account but you. I think that's what we really have seen over the past years, that we run over 210 checks on every individual, which means we have a really holistic view of who you are, the type of device you're using, the location where you're using your app from, and all these data points later on will help us confirm, um, that it's still you. Or on the flip side, and unfortunately we see that as well, where that's actually someone else trying to get access to your account and making sure that that is not successful.

Speaker A: I see. I guess that's what you meant by saying that as a customer you want to make sure that your savings are protected so you extend your solutions from KYC to anti fraud throughout the entire relationship between the financial institution and the end customer, Correct?

Speaker C: Absolutely. And I think historically, if you go back to the example of me walking into the bank branch back in the days, KYC was treated as uh, a snapshot in time. So it was a representation of certain information that was valid on that day. And in my case probably what they did is they made a black and white photocopy of my passport, put in some folder in the bank branch and no one could access that ever again. I think if you look at, um, the way the market is moving and especially with recent developments in Genai, that simply doesn't suffice anymore. You want to make sure that you create a movie where I have a better understanding of who you are and what represents normal behavior for you. So if you have opened an account with the latest generation iPhone, um, and you were doing that from Switzerland and now all of a sudden someone is trying to gain access to your account using an old generation Android from Russia, then that's probably something that, that should be looked at more closely. And that's a simple example of things that we see time and again. And I think that's where people really need to realize how powerful technology can be in protecting what is most dear to them. Their identity, their account, their savings.

Speaker A: Right, so, so that's a good example. But maybe if you can tell us a bit more because I hope that also anti fraud is getting better. Right. In the good old days, let's say that you traveled a lot for work. So you're based in Switzerland and you were uh, at work for work in, in Serbia. The next month you were for vacation in Mexico. And then what happens? The the bank will block your card because they think there's some fraud going on. They don't know you at all. This is completely normal for you. Right. So you said you have 200 kind of data points about people predicting better and not knowing them by blocking the card when it's not needed. So that's the other thing. Right, let's not overdo it. So how do you do it these days?

Speaker C: No, I think it's a fantastic example and I think maybe one point to mention we indeed run 210 checks. But I think we also need to realize that the platform that we've built and the checks that we run are never finished. The world is continuously changing. We've seen over the past two years on the back of Genai that for example, the quality of deepfakes has increased to a very, very impressive level. Which means that it's becoming more and more important to have this layered approach that I referred to earlier on where our theory is that there's no single silver bullet check that will prevent fraud in every case. You need to look at all these data points and you need to look at all these data points in conjunction and be able to interpret what's going on and have a step up mechanism thereafter. And in your specific example, uh, of traveling, I'll give you a positive example and I'll give you a negative example. So the positive example would be. Exactly. The use case you're describing was the setup that one of our broker clients had so they wouldn't allow you to trade in equities if you were traveling outside of the European Union. Now um, imagine you're in the U.S. the market is tanking and you cannot do anything that's not a great user experience. So even though they still maintain the check round geolocation, the step up mechanism that they implemented using four times technology is to allow you to take a selfie. If you're outside of the European Union, then our technology can make sure it's actually you trying to access the account and then all of a sudden you could trade even though you were in a different location. So it's not just about blocking, um, the bad actors, it's also about confirming bonafide. But if we then look at a negative example, we had a fraud trend about two years ago where accounts were opened up in different European countries. View persons, view ID documents. There was nothing funny going on at the time of onboarding. But when we asked for delocation later on, accounts popped up in Benin in western Africa and worse. So different accounts of different Europeans popped up in the exact same geolocation in Benin in western Africa as an example of a professional money laundering crew that had recruited money mules, typically targeting vulnerable people in the age groups of either 18 to 21 or above 65. These people had been paid money to go through an onboarding process and then the criminals use their credentials thereafter. And I think it shows the power of technology. If you have these ongoing checks, you're actually able to detect that and you're also able to then build patterns over time. Where we leverage data science to look at all the sign ups that we see in all the geographies that we're active in to make sure you're becoming better at predicting cases of money muting. I think that's the power of data that we see every day in practice.

Speaker A: All right, brilliant. So I understand it's a dynamic solution. You leverage AI, we can get to more details about that. But you know, there are many solutions like that out there. So why would Revolut or Rabobank PQ versus any other anti fraud or KYC solution?

Speaker C: Well, I think there's a couple things that are really important these days. So on the one hand, people will look whether you can actually meet their regulatory requirements. And I think if you look at the European market, where the majority of our business is, it's the toughest market to crack. It's where the strictest requirements around privacy and the strictest requirements around anti money laundering converge. And the reason that we've been able to crack it successfully is because of the fact that we are a regulated financial institution ourselves. And it means we have a very, very deep understanding of the European framework, but also of the implementation in different European countries. And I always joke that in fourth grade in high school I dropped German and never looked back. But I read the gertbergazettes in German to make sure that we really fundamentally understand what the requirements are from law. And that is unique to fourth line, that really deep understanding. But then the second step is we can actually solve for these regulatory requirements with proprietary technology. And I think what you see happening a lot in our industry is that people are reselling third party solutions, for example, around Liveness, which is a fundamental element in this process. Almost all of the vendors in the industry will leverage third party technology. We've built it in house ourselves. And why does it matter is because we also spend a lot of time speaking to financial regulators across different geographies. And it may come as a surprise to some of your listeners, but regulators are actually much more open to AI than a lot of people realize. And they will ask tough questions. They'll ask tough questions as to how the model was built, how it was trained, what training data was being used, how these results were being validated, how you can have an audit fill later on. And the only way to effectively answer that is if you control the technology, if you actually have done each of these steps yourself. And I think that's incredibly important in the era we're entering right now where financial institutions want to embrace AI. They are convinced about the added value of AI, but they also want to make sure that they're doing it in a way that is okay with the regulator, that doesn't get them into trouble with their end customers. So you want to make sure that it is an inclusive solution and that you can only do if you have proprietary technology. And fordland really has spent a lot of time, a lot of effort, a lot of money on, um, building that proprietary technology in house. But it also means you can just deliver a way better solution to the banks and fintechs that we serve.

Speaker A: All right, brilliant. So proprietary technology, enterprise grade AI solution, understanding and appreciation of regulatory standpoints, correct?

Speaker C: Absolutely. And I think let's not forget about the UX element. Right. In the end, uh, especially if you work with very demanding fintechs, they want to make sure that you offer the best UX to their clients, making sure that the onboarding process is a great first interaction with their new bank.

Speaker A: Okay, so I think coming back to that point, as you said, you are a B2B.C company. Maybe every company that is in B2B should remember that. Right?

Speaker C: Yeah, I mean, I think it's important. And I think it's important, especially in the context of what I mentioned earlier. This is not just about meeting regulatory obligations. People Oftentimes forget about the underlying point there, which is you want to preserve the integrity of the financial system. And again, I cannot repeat it often enough. We want to make sure that your identity, your account and your savings are really safe. And that is the way to think about KYC going forward, where it's actually a gift to your clients because you're helping them set up their account in a way that allows them to protect it going forward.

Speaker A: All right, so turning attention over to you now, how do you make money?

Speaker C: So in the end we make money in two different ways. We have products that we sell on um, volume based pricing so essentially linked to the number of new clients that you're onboarding or the number of existing clients that you're vky. And on the other hand we have products uh, where we bill on a subscription basis. So as an example of the latter, we can check whether you're on a sanction list today and if you're all clear that's fantastic. But who knows what you're up to next month. So we have a solution there where on a daily basis we Update north of 100 lists globally and we can run checks whether your existing clients or all of a sudden pop up on one of these lists and that's a subscription model. And on the other hand the example would be you ah, opening account, running the checks that I just referred to. And then we charge a fee per client to the banks and the fintechs that we serve.

Speaker A: I see. All right. And uh, we already talked about your target clients. You're based in the Netherlands but you said you have 250 employees. So is everybody based in uh, the Netherlands, in Amsterdam or where?

Speaker C: No. So if you go back to my opening remarks and my personal background, I think if you've been exposed to an international mindset at an early age, it's impossible to go back if you come from a small country like the Netherlands. By definition you need to look beyond the borders if you want to build and scale a really big company. So the way we set the team up from day one is we consider Europe are core market. So we, we've processed ID documents from 210 countries including a diplomatic passport from the Vatican. That's about as exotic as you can get with ID documents. But the, the core of our business is, is really in the EU and the UK and we do that with a, a team that's very international as well. So we have people from literally all over the world, 50 nationalities as just mentioned and, and the headquarters in Amsterdam, the Netherlands. We also have a secondary office in Barcelona and Spain. And then we have a couple of employees who sit in other geographies to make sure that we're tapped into local markets.

Speaker A: I see. All right. Okay, Great stuff. Now, we talked about your business, but we, uh, didn't really say how long you've been at this. Right. Or it wasn't clear, at least to me. So how long have you been running fourth line?

Speaker C: So we, we launched our product in, in January 2018 and as explained, we spun out of the other company in the summer of 2019. So we've been at it for a while. And especially if you look at all the attention that AI has been getting in the past two years, realizing that we've been investing in AI for over eight years really shows how important that is to, to the core of the company. As mentioned, Tmart of 250, we've raised just over 70 million in VC funding that has been invested in building this really high quality AI first scalable platform. And now it's really about further growth, making sure that we execute on the opportunities we see in the market.

Speaker A: I see. All right, so now sometimes people pivot from being B2C to B2B. Right. Because it's hard to be a B2C company sometimes. Sometimes it's the nature of the product, like in your case. Uh, but in any case, it's always good to talk about success a few years down the line. But what were your first steps? How did you get your first few customers?

Speaker C: Yes, I think it comes back to the origin of the business that we faced a problem ourselves. And I think that's always a very healthy starting point. So you obviously have companies that start from a grand vision of something that people think they can build, that they think they can solve. But in our case, it was a hard necessity. We were facing a challenge where we need to meet our regulatory obligations. We had reviewed available technology, didn't think it was good enough. So we needed to solve something, but we really needed to solve it for ourselves. Which means that the way you go about it is not sort of the classical Silicon Valley fake it till you make it. That doesn't work in this situation. So we really build something that from day one needed to solve a very tangible problem for ourselves. And I think that's shown to be the strength going forward because that meant that companies came to us asking whether they could use the platform because of the fact that we had solved for something very fundamental, which is instead of the six different point solutions that I referred to earlier. If you bring that all on one platform, these point solutions can actually talk to each other. And that means you can unlock a fantastic advantage of using the data insights of one step to optimize a second step. An example would be sanctioned screening. So historically the way vendors have approached the problem is they take your full legal name, apply some fuzzy logic and then tell a bank 8% of your clients are a potential hit. Now you go manually investigate that 8% which is extremely time consuming, it's very expensive and it's very error prone. And one of the things we were able to do on this single platform with a uh, unified data model is say, wait a second, we actually know a lot more about this client already than their full legal name because we also ran checks on their ID documents. So we know nationality, date of birth, place of birth, other data points. And that allowed us to get false positive elimination to north of 95%. We then have a team that can investigate the remaining part, which means all of a sudden we can go out to the market and say for email monitoring we can give you a zero false positive guarantee. And that just takes you to a completely different level where I think the interest came to us naturally because of the added value that we were providing to the banks and fintechs that we worked for initially and a very strong word of mouth. So almost in every sales process we offer prospects the possibility to speak to existing clients. And that has been incredibly powerful in the end in this industry people want to know you're a safe pair of hands and we can tell them, but it's way more powerful if an existing client can tell them how happy they are with our solution.

Speaker A: I see. All right, so you're basically an in house solution and then you open it up to externals and separate it from the original business. All right, Okay. I mean that's, you had advantage to some degree, but also that's still not uh, easy. Right. Because a lot of banks have all kinds of solutions that they try to externalize and make money out of them, but then they realize they're too customized. So it only works for them. Right. So if you said that, you said before that it's cloud native, it's modular. Right. So it is something that can work for other people than just one company. Correct?

Speaker C: Absolutely. And I think the challenges we see is there's differences in the type of use cases there with the risk associated with it. So I mean in some cases fraud is the cost of doing business. In other cases fraud can, can be an existential threat. So you need to make sure that you understand the use case, that you understand the regulatory regime which as mentioned differs per country and also depends on the uh, risk appetite of a financial institution. So you want to be able to offer a solution that, that is modular in terms of the steps that you apply, but it's also configurable. So you want to make sure that you get to choose as a financial institution, for example, which nationalities you accept. And there may be financial institutions that choose to not accept you as persons where as others want to do it. And you want to make sure that you can configure all these settings to really solve for the need of that specific financial institution.

Speaker A: Absolutely. So uh, what are your next steps for this year and beyond? You said you raised 70 million in VC funding, you have 250 employees, you have, you know, big name clients. What do you want to do next?

Speaker C: So I mean I think there's two really big themes in the market today. One is obviously Genai. I briefly touched upon what we've seen happening on the deepfake side, but I think more in general Genai has made fraudsters more scalable. So it means we're seeing new types of fraud, uh, trends emerge and we need to make sure that our technology keeps up with that. So we're investing a lot in that aspect. And I think there's actually a lot of extremely cool things you can do on the defensive side as well. And people sometimes don't realize if they talk about Genai and the threat it brings to the financial system, how extremely powerful it is as a defensive tool. So that's a big topic for us. I think the other thing, and this is again specifically to Europe, but there is a very big regulatory change coming up. At the end of next year we'll see the introduction of the EU digital identity wallets and uh, followed by in July 2027 an uh, AML regulation where for the first time we actually move away from the directive that led to all the gold plating in the different European countries to a single AML regulation that prescribes very explicitly which remote onboarding solutions banks can use. We think that's a fantastic development. We're building towards that very actively and we're very excited about the prospect that will bring to our growth because of the fact that what you referred to earlier on, some banks have in house solutions, some banks work with vendors that are not properly set up for this regulatory change. So for us it's a fantastic opportunity to capitalize on.

Speaker A: All right, brilliant. So Crick, One last question is where can interested parties contact you and what kind of people would you like to hear from most?

Speaker C: So I'm active on LinkedIn. First name is Crick, which is a pretty unique one already. Last name is Gunning. So there's only one QVIK gunning on LinkedIn and I would love to connect to your audience, sharing a lot of insights there on LinkedIn. And people can of course also visit fourthline.com and I'd love to hear from them because, uh, I know you have an audience that is active in this industry, so we'd love to share our insights with them.

Speaker A: Brilliant. So thank you so much Crick and good luck to you and fourthline.

Speaker C: Thanks so much for having me.

Speaker B: Thank you for listening to Voice of Fintech Podcast. If you haven't already, check out also voiceofintech.com where you will find all the episodes and additional resources related to the podcast. You can also subscribe to Voice of Fintech on Apple Podcasts, Spotify, Google, or any other podcast app that you like. If you have any suggestions on the topics or guests or how to make this podcast better for you, please email us@infoooiceofintech.com Happy to hear from you. Thank you.