Digital Domain Audit: Lloyds Banking Group

Target: Lloyds Banking Group plc (UK bank; incl. Lloyds Bank, Halifax, Bank of Scotland, Scottish Widows) Domain: Digital (Digital / Technology) Date: June 2026 Scope: Lloyds Banking Group’s own digital/data/cyber/surveillance/AI conduct re Israel.

Enterprise Technology Stack & Vendor Relationships

Lloyds Banking Group’s (LBG) declared technology estate centres on a multicloud architecture anchored by Google Cloud, Microsoft Azure, and Oracle, with FICO and IBM as significant enterprise software and research partners.

Google Cloud (US-domiciled): In April 2025 LBG announced a strategic partnership with Google Cloud, migrating 15 machine-learning modelling systems to Google Cloud’s Vertex AI platform; over 300 data scientists now use the platform, with 18 generative-AI systems in production.¹ Google Cloud is US-domiciled.

Oracle (US-domiciled): In March 2025 LBG expanded a multi-year collaboration with Oracle, migrating critical databases to Oracle Database@Azure (Oracle Cloud Infrastructure running inside Microsoft Azure datacentres) and Oracle Exadata Cloud@Customer.² Oracle is US-domiciled.

Microsoft (US-domiciled): In June 2026 LBG and Microsoft announced a multi-year deal to deploy Microsoft 365 E7, Agent 365, and expanded Copilot capabilities, with 40,000 Microsoft 365 Copilot licences already active.³

FICO (US-domiciled): LBG deployed the FICO Platform to migrate its lending infrastructure to the cloud, supporting over £7 billion in annual loans.⁴ FICO is US-domiciled (Bozeman, Montana); FICO has a separate commercial partnership with the Israeli firm Open-Finance.ai that is unconnected to LBG’s deployment.⁵

IBM (US-domiciled): LBG and IBM conducted a quantum-computing experiment on IBM’s Quantum Heron device, applying quantum graph algorithms to money-mule identification.⁶

NICE Actimize (Israeli-domiciled parent): NICE Actimize, a subsidiary of Israeli-headquartered NICE Ltd, is among the most widely deployed AML platforms in UK retail banking, but LBG’s financial-crime press releases describe its fraud/AML operations using LBG’s proprietary Dynamic Risk Engine and the Envoy platform, with no mention of NICE Actimize.⁷ No public evidence identified of a NICE Actimize contract at LBG.

CyberArk (Israeli-domiciled): Third-party commentary cites Lloyds Banking Group among UK financial-institution CyberArk (privileged-access management) deployments, but LBG has made no official public confirmation of a CyberArk contract.⁸ No verified public disclosure identified of a CyberArk deployment at LBG; the commercial-commentary claim has not been independently confirmed.

Check Point Software (Israeli-domiciled): No public evidence identified of LBG using Check Point network-security products.

Thought Machine (UK-domiciled): LBG invested in Thought Machine’s Series A in 2020 and uses its Vault Core cloud-native core-banking platform.⁹ Thought Machine is UK-domiciled (London); it has expanded commercially into Israel (winning Israeli bank clients) but is not an Israeli-origin vendor.

Surveillance, Biometrics & Retail Technology

Yoti (UK-domiciled) - Lloyds Bank Smart ID: In October 2023 LBG launched Lloyds Bank Smart ID, a reusable digital-identity application built with Yoti, a UK digital-identity company.¹⁰ LBG invested £10 million in Yoti in March 2023.¹¹ The app uses Yoti’s facial-biometric liveness detection to link a user’s face to their passport or driving licence, creating a reusable credential.¹⁰ Yoti is UK-domiciled (founders Robin Tombs, Duncan Francis, Noel Hayden - all British) with no identified Israeli connection.

Agentic AI fraud system - Envoy platform: LBG’s agentic AI fraud system (2026) runs on Envoy, LBG’s internally developed secure AI platform powered by Google Cloud, deploying multiple AI agents to conduct identity checks, transaction analysis, and scam-risk assessment in real time, with human override retained.¹² The system is proprietary; no third-party surveillance vendor is disclosed.

Dynamic Risk Engine (DRE): LBG operates the proprietary DRE, an ML platform scoring every debit-card authorisation in real time with sub-10ms responses.⁷ No Israeli-origin vendor component is identified.

No public evidence identified of LBG deploying facial-recognition technology in physical branches, or of LBG using Israeli surveillance technology vendors.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

LBG’s primary AI/ML cloud is Google Cloud with strengthened UK data-residency commitments for Gemini processing.¹ Databases run on Oracle Database@Azure within Microsoft Azure datacentres (14 regions; no Israeli region named).² Oracle Exadata Cloud@Customer runs in LBG’s own datacentres.² The June 2026 Microsoft 365 E7 agreement enforces UK-datacentre processing.³

No public evidence identified of LBG data processing or infrastructure within Israeli-domiciled cloud regions or participation in Israeli sovereign cloud programmes.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence has been identified of LBG maintaining direct technology relationships with Israeli intelligence agencies, Israeli defence contractors, or Israeli Unit 8200-linked cybersecurity vendors.

LBG’s IBM quantum collaboration targeted financial-crime detection (money-mule identification), a civil-financial application with no defence nexus.⁶

Curve acquisition - IDF-background founder: LBG agreed in November 2025 to acquire Curve, a London-domiciled digital-wallet fintech, for approximately £120 million.¹³ Curve was founded in 2015 by Shachar Bialick, an Israeli national and former member of the Israeli special forces who left service before founding Curve in the UK.¹⁴ Curve is registered and headquartered in England (London); it is a UK-domiciled company, not an Israeli-domiciled vendor. The founder’s IDF background is biographical context, not evidence of an ongoing operational relationship with Israeli defence or intelligence structures.

No public evidence identified of LBG procuring technology from Israeli Unit 8200 alumni companies, Israeli signals-intelligence contractors, or Israeli defence-sector technology vendors.

AI, Algorithmic & Autonomous Systems

Google Cloud Vertex AI: As of April 2025, LBG migrated 15 modelling systems to Vertex AI, operating 80+ ML use cases and 18+ production generative-AI systems; generative AI delivered ~£50 million of value in 2025, with £100 million projected for 2026.¹¹⁵

Envoy - proprietary agentic AI platform: Envoy is LBG’s internal AI platform (Google Cloud-powered); the agentic fraud system built on it performs real-time checks across 21 million customer accounts.¹²

FICO Platform - credit decisioning AI: Used for credit-card and personal-loan origination across £7 billion annual volume.⁴

Aveni FinLLM (UK-domiciled investee): LBG invested in Edinburgh-based Aveni’s £11 million Series A in July 2024 and co-develops FinLLM, an LLM built for UK financial services.¹⁶

UnlikelyAI - neurosymbolic AI trial (UK-domiciled): In July 2025 LBG partnered with UnlikelyAI to test neurosymbolic AI in its Innovation Sandbox.¹⁷

IBM Quantum: A nine-month trial (concluded April 2026) applied quantum graph algorithms to money-mule detection; described as experimental.⁶

No public evidence identified of LBG using Israeli-origin AI vendors (Pagaya, Personetics, or similar) in its production stack. No specific FCA enforcement action against LBG for algorithmic bias has been publicly announced.¹⁸

Technology Ecosystem & R&D Footprint

LBG’s identified fintech portfolio is UK/US-domiciled: Thought Machine (UK, core banking),⁹ Aveni (UK, AI compliance/FinLLM),¹⁶ Moneyhub (UK, open finance),¹⁹ Yoti (UK, digital identity),¹¹ Ocula (UK, AI personalisation),¹⁹ UnlikelyAI (UK, neurosymbolic AI).¹⁷

Curve acquisition (London-domiciled, Israeli-founded): LBG’s most significant fintech acquisition - Curve, a UK-registered digital-wallet company founded by Israeli national Shachar Bialick - was agreed November 2025 for ~£120 million.¹³ Curve is UK-domiciled (~six million users); its technology is intended for integration into LBG’s mobile banking. The Israeli-origin founder is a matter of biographical record; the company holds no Israeli domicile, and the acquisition does not constitute a procurement relationship with an Israeli-domiciled entity.

LBG operates an annual Launch Innovation Programme scouting early-stage fintechs; no Israeli-domiciled startups have been publicly identified as participants.²⁰

No public evidence identified of LBG operating a technology hub, innovation lab, or R&D presence in Israel, or of LBG making equity investments in Israeli-domiciled technology companies.

Civil Society Scrutiny & Regulatory History

Employee pro-Palestine disciplinary cases (2021–2026): Two Muslim employees of LBG, Afra Sohail and Aungbeen Khalid, were subjected to disciplinary proceedings in 2021 after posting messages to internal communications channels calling on the bank to divest from and boycott companies accused of profiting from Israeli actions against Palestinians; the bank sanctioned them and reported them to the FCA for gross misconduct.²¹ The employees sued LBG for religious discrimination in 2022.²¹ In February 2026 an Employment Tribunal found in LBG’s favour on the discrimination claims, but characterised the bank’s disciplinary conduct as “heavy handed” and found the sanction exceeded what was justifiable.²² The case attracted attention from Middle East Eye, the European Legal Support Center, and other civil-society organisations as evidence of institutional suppression of Palestinian solidarity advocacy within UK financial services.²³

Investment scrutiny: LBG is among UK banks listed by Ethical Consumer as having financial ties to companies operating in or supplying Israel; War on Want’s “Deadly Investments” report identified LBG among UK banks whose portfolios include arms suppliers active in Israel.²⁴²⁵ These concern investment/lending activities (assessed under Economic/Military) rather than LBG’s own technology procurement.

FCA AI bias environment: The FCA’s December 2024 AI-bias research initiative constitutes the primary regulatory risk environment for LBG’s AI deployments.¹⁸ No FCA enforcement action against LBG for AI-related misconduct, and no specific ICO enforcement action related to biometric data or digital-identity systems, has been identified in the search period.

End Notes