Cowrie Research

sardine

4 min read

Sardine

  • Name: Sardine
  • URL: https://www.sardine.ai/
  • Category: fraud / AML / identity-risk operations company
  • Summary: Sardine belongs in companies/ because the useful question is not whether Sardine names a neutral protocol or one tidy product. The practical control surface is the named operator that sells and configures fraud prevention, identity verification, payment-risk controls, sanctions screening, transaction monitoring, case workflow, and agentic review tooling as one managed platform. That matters because downstream teams can start treating Sardine’s signals, thresholds, dashboards, and review flow as operational truth across onboarding, payments, and AML.
  • What it does:
    • Packages one risk platform spanning device and behavioral signals, onboarding checks, fraud prevention, cyber-security monitoring, and AML compliance operations
    • Sells identity and business verification flows including KYC, KYB, sanctions screening, ongoing screening, document checks, bank verification, and related onboarding controls
    • Operates payment-risk and fraud products for bank transactions, card-issuing fraud, merchant monitoring, refund fraud, policy-abuse detection, and account-takeover defense
    • Provides transaction monitoring, customer risk rating, case management, and sponsor-banking controls so fraud and compliance workflow stay inside one vendor shell
    • Uses sandbox access, authenticated docs, and API-driven integration paths that make production access and workflow configuration part of the company boundary rather than a generic open standard
  • Key claims:
    • Sardine’s homepage now brands the company as The agentic risk platform for fighting financial crime and says it unifies fraud prevention, AML compliance, and real-time transaction monitoring in one platform
    • The homepage groups the stack into Device and behavior, Onboarding, Fraud prevention, Cyber security, and AML Compliance, which is unusually explicit evidence that Sardine should be read as a workflow platform rather than as one narrow screening API
    • The official docs hub says teams can Manage Risk with Sardine, frames the docs as tech docs for integrating Sardine’s platform, and says full technical documentation requires login, which makes customer admission and authenticated workflow access part of the operator boundary
    • Public getting-started materials tell prospects to request sandbox access, schedule a demo, and then move through integration guides and API docs, which shows a staged vendor-controlled path from evaluation to production
    • Public risk-overview docs explicitly tie Sardine to KYC, KYB, sanctions screening, payment-fraud mitigation, account-takeover defense, and AML transaction monitoring rather than only one compliance niche
    • The public GitHub organization is verified for sardine.ai, which is useful supporting evidence that the company maintains a real engineering and docs surface even though much of the deeper documentation is gated
  • Whitepaper: No standalone Sardine whitepaper is the point here. The strongest primary-source snapshot remains ../whitepapers/sardine-primary-sources-2026-04-22.md, now supplemented by the current homepage and docs wording reviewed in this pass.
  • Sources:

Internal linkages

  • Project-layer alias: sardine.
  • Useful adjacent compliance-workflow reads: sumsub, scorechain, and chainalysis.
  • Keep this note on the named operator boundary: the integration surface is real, but the leverage sits in the company-managed risk workflow around it.

Protocol / company boundary

  • There is not a very useful standalone Sardine protocol boundary doing the analytical work here.
  • The important questions are who decides which signals exist, how risk is scored, which alerts get generated, what sandbox and production access look like, how case workflow is structured, and how much of onboarding and payments policy gets routed through one vendor relationship.
  • That is why Sardine belongs in companies/: the managed platform is the product, and the named operator is the control surface behind it.

Control surface

  • Practical authority sits in sandbox and production admission, API and dashboard access, risk-model and rules configuration, screening and monitoring thresholds, case-management workflow, and the way Sardine’s outputs can become operational truth for fraud, AML, and onboarding teams.

  • The sticky part is not only detection quality. It is organizational dependence: once identity checks, payment-risk review, transaction monitoring, and case resolution all run through Sardine, the company becomes part of the customer’s live control plane.

  • Read Sardine as a managed fraud-and-compliance operations company, not as a neutral protocol or a simple point product.

  • Last reviewed: 2026-08-09 UTC

Graph View

Backlinks