Digital Audit: Monzo

Enterprise Technology Stack & Vendor Relationships

Monzo’s core banking platform runs on Amazon Web Services, comprising more than 400 microservices deployed across EC2, EBS, S3, EKS and Keyspaces, orchestrated with Kubernetes and Apache Cassandra, written primarily in Go and connected via Kafka ¹². In parallel, Monzo operates a disaster-recovery banking backbone known internally as “Stand-in,” built on Google Cloud Platform to allow continued basic banking functions during full AWS outages ³. Beyond disaster recovery, Monzo has built an integrated data-analytics and machine-learning estate on GCP, including BigQuery (holding roughly 19PB of data), Looker and Vertex AI ⁴⁵⁶⁷. Monzo is also executing an ERP and digital-transformation programme on SAP S/4HANA Cloud and SAP Business Technology Platform, delivered with systems integrator NTT DATA Business Solutions, a Japanese-headquartered firm with no Israeli ownership or nexus ⁸. No public evidence identified of licensing, subscription, or integration relationships between Monzo and Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks. Monzo’s identity-verification and biometric onboarding function is supplied by Jumio, a company headquartered in Palo Alto, California and founded in 2010 by Daniel Mattes - not an Israeli firm - with the relationship documented from 2017 and extended/renewed at least through 2019 ^9101112. No public evidence identified that Monzo uses named third-party AML/fraud-detection vendors such as ComplyAdvantage, Quantexa, ThetaRay, NICE Actimize, Feedzai, Sardine, Riskified, Unit21, Forter, or Personetics; primary sources instead describe an in-house, proprietary fraud-detection system built on GCP BigQuery/Vertex AI and AWS microservices ⁷. The Financial Conduct Authority’s July 2025 enforcement notice, which fined Monzo £21m for financial-crime-control failings between October 2018 and June 2022, characterises the deficient controls as Monzo’s own internal, largely manual, post-event transaction-monitoring processes, and does not name any third-party AML technology vendor ¹³¹⁴. No public evidence identified that Monzo licenses a third-party core banking platform (e.g. Thought Machine, used by comparable neobank Monese); available sources describe Monzo’s core ledger and banking system as built in-house on AWS ¹.

Surveillance, Biometrics & Retail Technology

No public evidence identified of Monzo use of facial-recognition, biometric-matching, or gait-analysis technology supplied by Trigo, BriefCam, AnyVision/Oosto, or Trax; Monzo has no physical retail footprint of the kind these tools are marketed for, and its only biometric function is device-native Face ID/Touch ID used for app login, which is an Apple/Google operating-system feature rather than a third-party Israeli product. Monzo’s KYC-facing facial biometric matching for account onboarding is instead supplied by Jumio, a US-headquartered vendor with no Israeli origin ⁹¹¹. No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools in use at Monzo. No public evidence identified of indirect or bundled delivery of Israeli-origin surveillance or biometric technology to Monzo via managed security service providers or platform bundles.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that Monzo operates, leases, or co-locates data-centre infrastructure in Israel; Monzo’s published position states that UK customer data is stored in the UK, with a separate legal disclosure covering its (discontinued/limited) US subsidiary and GDPR treatment of customer data ¹⁵. Monzo’s cloud footprint is limited to being a customer of AWS and Google Cloud for its own banking, disaster-recovery and analytics infrastructure ¹³. No public evidence identified of Monzo participation in Project Nimbus or any comparable Israeli state-backed cloud programme; Monzo’s role as a cloud customer rather than a cloud or infrastructure provider distinguishes its position from vendors such as Google, AWS, or Microsoft that are themselves Nimbus contractors. No public evidence identified that Monzo provides data-sovereignty, data-residency, or infrastructure-resilience services to Israeli state or military institutions, as Monzo does not sell infrastructure services to third parties and operates solely as a retail/business banking app for UK (and formerly US) consumers.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any contract, partnership, or service agreement between Monzo and the Israeli Ministry of Defence, the IDF, or Israeli intelligence or security bodies. No public evidence identified that Monzo’s commercial technology - a consumer/business banking application - has been reported, confirmed, or documented as deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the occupied territories. No public evidence identified of Monzo developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day tools, or digital-weapons systems, nor of any Israeli state actor deploying Monzo-originated technology.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Monzo providing AI/ML, computer-vision, or autonomous decision-support systems to Israeli state, military, or security bodies; Monzo’s disclosed AI/ML work - covering fraud detection, natural-language chat routing, and spend insights - is built in-house on Google Cloud’s Vertex AI and BigQuery exclusively for its own UK and US retail-banking customers ⁷. No public evidence identified that Monzo’s AI models have been trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the occupied territories. No public evidence identified of Monzo providing autonomous target-generation, automated threat-detection, or autonomous-tracking systems to any military or security force, consistent with Monzo’s product line being limited to consumer and business banking.

Technology Ecosystem & R&D Footprint

No public evidence identified of a Monzo research-and-development facility, engineering office, innovation lab, or accelerator programme in Israel; confirmed Monzo engineering and office locations comprise the UK headquarters, a US office in San Francisco, an Ireland presence, and a Barcelona engineering hub, with no Israel location surfaced in any source reviewed. Monzo’s only confirmed acquisition to date is Habito, a UK digital mortgage broker with roughly 100 employees, announced on 16 December 2025 and expected to complete in spring 2026; Habito has no identified Israeli technology nexus ¹⁶¹⁷. No public evidence identified of any Israeli-origin company acquisition or Israeli startup/venture-fund investment by Monzo. No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between Monzo and Israeli-domiciled entities or research institutions such as the Technion, Hebrew University, or the Weizmann Institute. Monzo’s board and executive roster is published on its corporate site and covered by trade press, listing members including Gary Hoffman, TS Anil, Eileen Burbidge, Anu Hariharan, Fiona McBain, Delfin Rueda Arroyo, Fields Wicker-Miurin, Jambu Palaniappan, Karen Peacock, Lizzie Runham, Spencer Lake, Valerie Dias, Vinay Yarlagadda and Tom Oldham ¹⁸¹⁹. TS Anil is stepping down as Group CEO after five years, with Diana Layfield, a Google veteran, named as his successor ²⁰²¹²². Per a career-anniversary account attributed to Diana Layfield and indexed via search from her LinkedIn profile, she was tasked early in her roughly nine-year Google career with setting up and leading Google’s operations in Israel, before later expanding into Russia, the Middle East and Africa; two independently fetched biographical pages covering her later Google roles (VP International Search & Growth, VP Next Billion Users, President EMEA Partnerships) and her AstraZeneca non-executive directorship do not themselves mention Israel, so this specific claim should be treated as sourced only to a search-indexed LinkedIn post rather than an independently corroborated primary document ²³²⁴²⁵. This Google-Israel role, as described, was a general commercial search/consumer-product operating position rather than an equity stake or personal investment in an Israeli surveillance or defence firm, and it predates her Monzo appointment by roughly two decades. No public evidence identified linking this history to Google’s later Project Nimbus contract or to any surveillance- or defence-specific Google Israel activity. Monzo’s investor base includes CapitalG, GV, HongShan, Passion Capital and Tencent among its funders ²⁶²⁷. No public evidence identified of equity stakes, board roles, or personal investments by other named Monzo board members or executives in Israeli surveillance, cyber, AI, SIGINT, or military-technology firms such as NSO, Cellebrite, Carbyne, AnyVision/Oosto, Wiz, Palantir, Check Point, SentinelOne, Verint, or NICE.

Civil Society Scrutiny & Regulatory History

No public evidence identified of Monzo appearing in the UN OHCHR Business & Human Rights database maintained pursuant to Human Rights Council Resolutions 31/36 and 53/25 ²⁸. No public evidence identified of Monzo appearing in the Who Profits, AFSC Investigate, or “Don’t Buy Into Occupation” company databases. Monzo’s published ethical-investment policy states that it invests only in government and quasi-government bonds and does not invest in fossil-fuel, arms, or tobacco companies; Ethical Consumer’s review of Monzo notes this exclusion positively while also flagging that Monzo’s ethical lending policy does not address broader human-rights criteria such as links to “oppressive regimes” ²⁹³⁰³¹. Monzo also publishes an annual modern slavery and human trafficking statement addressing supply-chain due diligence ³². No public evidence identified of an organised boycott, divestment, or sanctions campaign targeting Monzo specifically on technology-provision-to-Israel grounds. No public evidence identified of regulatory inquiries, export-control actions, or sanctions investigations involving Monzo’s technology sales or services to Israeli state entities; Monzo’s only identified major regulatory action is the FCA’s July 2025 £21.09m fine for AML and financial-crime-control failings between 2018 and 2022, which is unrelated to Israel or technology-export issues ¹³¹⁴.

End Notes