Digital Audit - Monzo Bank Limited

Audit Phase: Digital (Digital / Technology Forensics) Subject Entity: Monzo Bank Limited (Company No. 09446231; FCA FRN 730427) Registered Office: Broadwalk House, 5 Appold Street, London EC2A 2AG, United Kingdom Audit Date: June 2026 Evidence Base: Monzo engineering blog and corporate disclosures, vendor press releases, FCA regulatory notices, trade and technology press, NGO/civil-society databases, and security-incident reporting. All factual claims are drawn from publicly available sources cited in the End Notes.

Scope and directionality note: Digital assesses the digital/technology nexus to Israel. The serious case is the provision of surveillance, digital, data, or cyber technology to the Israeli state, military, or security services. The reverse direction - Monzo procuring technology from Israeli-origin vendors - is a customer relationship and is recorded explicitly as such, weighted far lower than provision. No transitive guilt is imputed: an Israeli vendor’s other clients, its founders’ military backgrounds, or an investor’s separate holdings are not attributed to Monzo. US-entity relationships (e.g. Microsoft, AWS, Google Cloud, Datadog) are not Israeli-origin and are noted only for completeness. Cyberattacks or data incidents suffered by Monzo are recorded as events done to the company, not as provision.

Enterprise Technology Stack & Vendor Relationships

Core Architecture (Direction: Monzo as customer)

Monzo operates an in-house-engineered, cloud-native backend. Its core banking platform is built primarily in Go, deployed as a large microservices estate orchestrated on Kubernetes, with Apache Cassandra for persistence and Apache Kafka for asynchronous messaging.¹² Monzo’s primary production platform runs on Amazon Web Services (AWS), a US entity, using services including EKS and Amazon Keyspaces; its analytics and machine-learning estate is centred on Google Cloud Platform (GCP) BigQuery.²³ An independent disaster-recovery system, “Monzo Stand-in,” runs a reduced set of services on GCP so the bank can tolerate a full outage of its primary AWS platform.³ AWS and Google Cloud are US-headquartered providers; this is recorded for completeness and is not an Israeli-origin relationship.

Monzo’s engineering blog and third-party technology profiling describe a stack that also includes Apache Kafka (historically via Confluent’s managed service) and Datadog (a US, New York-headquartered company) for observability.¹² Monzo’s published material describes a strong preference for open-source, cloud-native and internally built tooling over proprietary vendor-managed deployments.¹

Identity Verification & KYC (Direction: Monzo as customer)

Monzo’s documented identity-verification/KYC vendor is Jumio, a Palo Alto / Sunnyvale, California-headquartered identity-verification company (founded 2010 by Austrian entrepreneur Daniel Mattes; not Israeli-origin). Jumio has provided Monzo’s biometric onboarding (document scan plus selfie/liveness) since 2017, with a multi-year extension announced in 2019.⁴⁵ Onfido (UK-origin, acquired by US-headquartered Entrust in 2024) has historically been cited as an early Monzo identity-verification supplier; neither vendor is Israeli-origin.⁶ In all cases Monzo is the customer.

Israeli-Origin Technology / Cybersecurity Vendors (Direction: Monzo as customer if any)

No public evidence was identified confirming that Monzo holds a licensing, subscription, or integration relationship with any Israeli-origin technology or cybersecurity vendor - including Check Point, Wiz, CyberArk, SentinelOne, Claroty, Verint, or NICE. Searches of these vendors’ customer listings and press releases surfaced no Monzo reference.⁷ Monzo does not publish a comprehensive supplier register, and its endpoint, SIEM, vulnerability-management, and cloud-security-posture tooling is not routinely named in public disclosures; Israeli-origin vendor exposure within that undisclosed tier can therefore neither be confirmed nor excluded on public evidence. No public evidence identified.

Systems Integrators & Procurement Partners

No public evidence was identified of Monzo engaging a major systems integrator (Accenture, Deloitte, IBM, Capgemini, Infosys, TCS, or comparable) for a large-scale digital-transformation programme; Monzo’s disclosures are consistent with an internally led engineering function.¹ No public evidence was identified that any third-party integrator mandated or deployed Israeli-origin technology within a Monzo engagement.

Surveillance, Biometrics & Retail Technology

Facial Recognition & Physical Surveillance

Monzo is a digital-only bank with no physical branch or retail store estate. Technologies typically assessed here - in-store facial recognition for loss prevention (e.g. Trigo, BriefCam, Oosto/AnyVision, Trax), gait analysis, or frictionless-checkout video analytics - are structurally inapplicable to its business model, and no public evidence links Monzo to any such system.¹ No public evidence identified.

Biometric Identity Verification (Onboarding)

Monzo uses selfie/liveness detection and document scanning at onboarding for KYC/AML purposes, supplied by Jumio (US, non-Israeli-origin).⁴⁵ Biometric facial verification is also used in-app for high-risk actions; the facial-recognition processing is performed by Jumio, with on-device fingerprint/face authentication handled through the customer’s mobile operating system.⁴⁸ No public evidence was identified of any Israeli-origin biometrics or facial-recognition provider in Monzo’s onboarding or authentication stack. No public evidence identified.

Predictive Analytics, Fraud Detection & Workforce Monitoring

Monzo’s fraud-prevention platform is documented as internally built - a modular, real-time control architecture using a feature-computation pipeline on BigQuery and ML models trained on Monzo’s own UK customer transaction and behavioural data.⁹¹⁰ Published engineering descriptions name no external Israeli-origin vendor in this system. No public evidence was identified of Monzo deploying Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools. No public evidence identified.

Monzo participates in UK cross-sector fraud-intelligence-sharing initiatives coordinated through Stop Scams UK, alongside other banks, telecoms (BT, Three) and US technology firms (Amazon, Google, Meta, Match Group); the data shared concerns suspicious URLs and abnormal transaction activity.¹¹ This is a UK domestic anti-fraud programme with no Israel nexus and no Israeli-origin vendor identified in public reporting.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Primary Cloud Infrastructure & Data Residency

Monzo’s production infrastructure is AWS-hosted with its analytics/stand-in estate on GCP, both US providers, operated for a UK-regulated bank subject to UK GDPR.²³ No public evidence was identified of Monzo operating, leasing, or co-locating data-centre infrastructure within Israel, or of any Israeli cloud availability zone or co-location provider in its stack.²³ No public evidence identified.

Project Nimbus & Israeli State Cloud Infrastructure

Not applicable. Project Nimbus is the Israeli-government cloud contract held by Google Cloud and AWS at the prime-contractor level; Monzo is a downstream commercial customer of AWS and Google Cloud, not a participant in, sub-provider to, or supplier under that programme.²³ No public evidence was identified of Monzo involvement in any Israeli state-backed digital-infrastructure programme. No public evidence identified.

Data-Sovereignty or Resilience Services to Israeli State Institutions

No public evidence identified. Monzo does not operate as a cloud, hosting, or managed-infrastructure provider to any state body, Israeli or otherwise; its commercial positioning is exclusively as a UK (and, intermittently, US) retail and SME banking product.¹²¹³

Sub-Processor Disclosure

Monzo’s privacy policy documents categories of sub-processors for UK GDPR purposes but does not publish a fully enumerated named-vendor sub-processor list at a granularity that would confirm or exclude Israeli-origin data processors operating below materiality thresholds.¹⁴ This is a bounded evidence gap.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence was identified of any contract, partnership, or service agreement between Monzo and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or Israeli intelligence agencies (Shin Bet, Mossad, or Unit 8200-linked commercial ventures). Monzo is an FCA/PRA-authorised UK retail bank whose disclosed activities are confined to consumer and SME banking.¹²¹⁵ No public evidence identified.

Provision of Technology / Data to the Israeli State or Military

No public evidence was identified of Monzo providing surveillance technology, data, software, cloud capacity, or digital services to the Israeli state, military, or security services. This is the directionally serious Digital case, and no qualifying evidence of it was found. No public evidence identified.

Dual-Use Technology Provision

No public evidence was identified of Monzo’s commercial technology being reported or confirmed as deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories. No public evidence identified.

Offensive Cyber Capability

No public evidence identified. Monzo does not develop, license, or sell offensive cyber capability, exploit tooling, or digital-weapons systems; this is structurally consistent with its regulated retail-banking model.¹⁵ Separately, in August 2019 Monzo disclosed that a software bug had caused some customers’ card PINs to be written into encrypted internal log files accessible to engineers, affecting around 480,000 customers (roughly a fifth of its then customer base); Monzo stated no party outside the company accessed the data, deleted the logs, and prompted affected customers to reset PINs.¹⁶¹⁷ This incident was an internal data-handling failure recorded as factual digital context only, with no Israel nexus and no provision of technology.

AI, Algorithmic & Autonomous Systems

AI/ML Provision to Israeli State Bodies

No public evidence identified. Monzo’s documented AI/ML work is internal - fraud detection, credit decisioning, customer-operations automation, and personalisation for UK retail customers, run on its own AWS/GCP infrastructure.⁹¹⁰ No provision of AI capability, model access, training data, or inference services to any Israeli state, military, or security body is documented.

Training Data & Model Development Involving Israeli Population Data

No public evidence was identified of Monzo contributing to, commissioning, or benefiting from AI model development involving Israeli population datasets, intercepted communications, or intelligence-derived data; published descriptions reference training on Monzo’s own UK customer transaction data.⁹¹⁰ No public evidence identified.

Autonomous Systems & Lethality

No public evidence identified. The development or deployment of autonomous targeting, military threat-detection, drone-guidance, or lethal autonomous systems is not within Monzo’s business domain.

Internal Algorithmic Deployment - Israeli-Origin AI Tooling

Monzo’s documented internal AI deployment runs on US-provider cloud (AWS, GCP).²⁹ No public evidence was identified of any Israeli-origin AI vendor embedded in Monzo’s stack; the undisclosed full vendor list means secondary embedding within managed services cannot be positively excluded, but no such instance was identified. No public evidence identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Facilities

No public evidence was identified that Monzo operates any R&D facility, engineering office, innovation lab, or accelerator programme within Israel. Monzo’s engineering is documented as London-anchored with distributed UK remote staff, and (from 2024) a US operation via a partnership with Sutton Bank, an Ohio community bank.¹¹³ No public evidence identified.

Acquisitions & Investments in Israeli Technology Companies

No public evidence was identified of Monzo acquiring, or taking a corporate-venture stake in, any Israeli technology company. Monzo’s documented fundraising (including a March 2024 round led by Alphabet’s CapitalG and earlier rounds involving SoftBank Vision Fund 2, Accel, General Catalyst, Thrive Capital, and others) does not feature Israeli companies as investees, and no Israeli-registered Monzo subsidiary or holding structure was identified.¹²¹³ An investor’s separate Israel-related holdings are not attributed to Monzo. No public evidence identified.

Patents & IP Co-Development with Israeli Institutions

No public evidence was identified of patent portfolios, licensing, or co-development arrangements between Monzo and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute). No public evidence identified.

Technology Supply-Chain Due-Diligence Framework

No public evidence was identified of a Monzo procurement or supplier-conduct framework that governs the national origin or geopolitical exposure of technology vendors, software suppliers, or digital-infrastructure providers. No public evidence identified.

Civil Society Scrutiny & Regulatory History

NGO & Academic Scrutiny - Technology Supply Chain

No public evidence was identified of an NGO investigation, academic study, or UN report addressing Monzo’s technology relationships with the Israeli state, Israeli defence entities, or Israeli-origin vendors. No Monzo entry was identified in the Who Profits Research Centre database or comparable civil-society corporate registers in relation to Israel/OPT technology activity.¹⁸ No public evidence identified.

BDS Campaigns

No public evidence was identified of an organised BDS campaign, shareholder resolution, employee petition, or public divestment campaign targeting Monzo specifically on grounds related to technology provision to Israel or operations in the Occupied Palestinian Territories.¹⁹ No public evidence identified.

Regulatory History - FCA Financial-Crime Enforcement

On 8 July 2025 the FCA fined Monzo £21,091,300 (reduced from £30,130,475 after a 30% settlement discount) for inadequate anti-financial-crime systems and controls between October 2018 and August 2020, and for repeated breaches between August 2020 and June 2022 of a requirement barring it from onboarding high-risk customers (over 34,000 such accounts were opened, including registrations using implausible addresses such as well-known London landmarks).²⁰²¹ This enforcement concerns AML/onboarding controls and Monzo’s rapid customer growth; it has no connection to Israel, the Occupied Palestinian Territories, or dual-use technology export.²⁰

No public evidence was identified of any action by UK export-control authorities, HMRC, the Office of Financial Sanctions Implementation (OFSI), the ICO, or any equivalent body relating to Monzo technology sales, services, or data transfers to Israeli state entities, or to operations in the Occupied Palestinian Territories. No public evidence identified.