Agentic AI
Build the models financial crime hasn’t had yet.
We study how AI can learn the language of financial behavior, anticipate new attacks, and help risk teams make better decisions without losing control.
Understanding the language of financial crime
Sardine AI Lab is an applied research group focused on a hard question: can models learn the structure of financial behavior well enough to catch attacks they were never explicitly taught to find?
We combine sequential transaction data, device intelligence, behavioral biometrics, and identity signals across Sardine’s global network. The goal is simple: turn research advances into measurable protection against financial crime.
Grounded in real risk
We evaluate against fraud outcomes and operating constraints, not abstract capability alone.
Built for deployment
Accuracy matters alongside latency, governance, explainability, and human oversight.
Open to scrutiny
We publish what worked, where it failed, and the questions the evidence cannot answer yet.
Built on the fastest-growing dataset in financial crime
Our research starts with the breadth of Sardine’s network and goes deep into the sequence of each customer’s financial behavior.
From billions of events to one learned representation
The model learns at the cardholder level, preserving the order, timing, and context that flat aggregations leave behind.
Data
Card-issuing histories from 13 issuers across consumer, SMB, crypto-card, and neobank programs. Coverage runs from January 2024 to July 2026, with up to 31 months per issuer.
Learning Unit
Each cardholder’s complete history becomes a single sequence, reaching approximately 2,300 transactions.
Schema
Each transaction contains 14 fixed fields spanning merchant, MCC, amount, timing, geography, entry mode, presence context, terminal information, and card balance.
Vocabulary
Approximately 72,000 tokens. The top 50,000 merchants receive dedicated tokens, the long tail maps to 20,000 stable hash buckets, and numeric values are quantile-binned.
Model
A Llama-style decoder with approximately 300 million parameters, trained through next-token prediction. It produces a 640-dimensional embedding for every transaction.
Four questions shaping our work
Financial crime is sequential, adaptive, and connected. Our research agenda is built around those realities.
Can financial behavior be learned as a language?
We train models on ordered payment histories to learn useful representations before a fraud label enters the system.
Can motion and interaction reveal the attacker?
We explore sequence models for behavioral biometrics, remote-access-tool detection, bots, and anomalous sessions.
What changes when every event enters one timeline?
We are studying whether transactions, logins, identity, device, and behavior signals can form one reusable representation.
Can models prepare for fraud that has not happened yet?
We are investigating reinforcement learning and synthetic attacks to make detection more robust to changing fraud patterns.
A stronger signal from the history already there
Our first payments foundation model learned from unlabeled transaction sequences, then supplied new features to the issuing fraud model already in production.
more fraud caught at the same share of transactions flagged for action
improvement in overall ranking quality, measured by AUC-PR
improvement for a client population held out of pretraining
Recall by action depth
- 0.05%7.2%
- 0.10%13.4%
- 0.50%35.5%
- 1.00%47.5%
- 2.00%38.7%
Action depth is the share of scored traffic selected for decline, freeze, or review.
Learn first. Classify second.
Tokenize merchant, amount, time, geography, channel, and terminal.
Pretrain on 10 months of unlabeled histories.
Represent each history with an eight-layer transformer.
Combine the features with the existing fraud model.
Promising is not the same as solved
The transformer did not replace the existing model. Its embeddings were weaker on their own; the combination beat either input alone. Issuing data also has an ideal shape for sequence learning: long histories and lean transaction detail. Explainability remains unresolved, latency needs production engineering, and we have not yet established how much of the gain is unique to transformers.
Bring us the hard problems
We want to widen who gets to work on financial crime research and make meaningful progress easier to measure.
Compete on the next generation of risk models
Sequential transaction modeling
Bot and remote-access detection
Explainable risk representations
Ideas, methods, and evidence
Read the work behind the numbers and follow the questions we are investigating next.
Building a foundation risk model
The full experiment: data preparation, tokenization, architecture, results, limitations, and what it will take to move from promising research to regulated production.
Why risk needs foundation models of its own
Financial data is ordered, relational, and sparse. General-purpose models were not built for it.
How a transaction becomes a token
A plain-language guide to turning payment histories into something a transformer can learn from.
Beyond transactions: one timeline for risk
What might happen when device, identity, behavior, and payments share a representation.
