INDEX / DIRECTORY / NATWEST / DIGITAL

NatWest DIGITAL

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-09-07
Digital Score 0.00 /10 C NatWest - BDS-1000 511
Digital 0.00

Evidence-only forensic audit. Scoring happens downstream - see the main dossier for the composite assessment.

Forensic audits like this are reader-funded - no sponsors, no ads. Support OpenIntel →

Domain: Digital / Technology
Entity scope: NatWest Group plc and its subsidiaries, including NatWest, Royal Bank of Scotland, Coutts, Ulster Bank, NatWest Markets, and RBS International businesses.1, 2, 3
Current ownership context: HM Treasury completed the sale of its remaining NatWest shares on 30 May 2025; it is therefore historical shareholder-level context rather than a current shareholder relationship on the cited record.4, 5

Enterprise Technology Stack & Vendor Relationships

NatWest Group reported annual technology expenditure of £1.2 billion in 2025.6

BioCatch (Israeli-origin behavioural biometrics): BioCatch announced that its behavioural-biometrics technology had been deployed from the start of 2016 within Coutts and for some NatWest business customers, for online and mobile fraud prevention and continuous authentication.7, 8, 9 The technology was described as capturing more than 500 behavioural indicators, including hand-eye coordination, pressure, hand tremors, navigation patterns, and scrolling, to generate user profiles and identify suspicious account-access activity.10, 8, 9 The 2016 announcement recorded an intended 2017 personal-banking pilot.8, 11, 9 The deployment is therefore confirmed for Coutts and some NatWest business customers, rather than for all RBS customers.9

BioCatch’s current materials describe a broader platform capable of collecting behavioural, device, and interaction signals, but they do not establish which later product version, features, or signals NatWest used.12 BioCatch (EMEA) Limited is an active UK company incorporated in May 2022; this corporate record does not establish a continuing NatWest contract.13

BioCatch current status: no public evidence identified that the 2016 deployment continued after the proposed 2017 personal-banking pilot, expanded to personal banking, was renewed, or was retired.8, 11, 14, 9 No public termination, extension, supplier-record, or later NatWest/Coutts production-use disclosure was located in the supplied evidence.14, 9

Featurespace (UK-domiciled - Cambridge): NatWest’s disclosed fraud and transaction-monitoring relationship with Featurespace began in 2019.15, 16 In February 2025, NatWest reported replacing its legacy fraud-risk and transaction-monitoring platform with the upgraded Featurespace Platform, reporting a 135% improvement in scam-detection rates and a 75% reduction in false positives.17 Featurespace is Cambridge-based and is not an Israeli-domiciled entity.15, 18

Dataiku (US/French-domiciled): NatWest Markets selected Dataiku’s data-science and machine-learning platform in April 2020.19

Malwarebytes (US-domiciled): NatWest Group partnered with Malwarebytes in September 2020 to provide endpoint protection to retail and business customers across NatWest, RBS, Isle of Man Bank, NatWest International, and Ulster Bank.20

IBM (US-domiciled): NatWest partnered with IBM in November 2023 to use watsonx for Cora+, a generative-AI digital assistant launched in June 2024.21

OpenAI (US-domiciled): NatWest announced a direct OpenAI collaboration in March 2025 to develop agentic capabilities for Cora.22 NatWest reported that 25,000 customers had access to the agentic financial assistant during Q1 2026.23

AWS / Accenture (US-domiciled): NatWest announced a five-year AWS and Accenture collaboration in July 2025 for bank-wide digital, data, analytics, and AI modernisation.24, 25

Google Cloud (US-domiciled): NatWest Markets migrated risk platforms and data-processing workloads to Google Cloud, including BigQuery, and trained 1,100 employees on Google Cloud Platform by 2021.26 Google Cloud’s case study also identifies NatWest Markets’ use of Google services for data-management and risk-platform work.27, 28

No public evidence identified of NatWest Group deploying NICE Actimize, Check Point, CyberArk, Pagaya, Forter, Riskified, Wiz, SentinelOne, Palo Alto Networks, Verint, Claroty, Trigo, BriefCam, AnyVision/Oosto, or Trax in its own production environment.29, 30, 31, 14

Surveillance, Biometrics & Retail Technology

Confirmed behavioural-biometrics deployment: BioCatch is the primary verified Israeli-origin technology deployment in the supplied record: it was used at Coutts and with some NatWest business customers from early 2016.7, 8, 9 The evidence supports passive behavioural profiling for fraud detection and continuous authentication, not a general deployment across all RBS or NatWest retail customers.10, 9

“6.4 million” proposition: no public evidence identified for a Tech Hub proposition that an Israeli cybersecurity technology protected 6.4 million RBS customers. RBS’s 2018 Overview uses the figure for customers using its mobile app and does not attribute their protection to a named Israeli cybersecurity vendor.32 The confirmed BioCatch deployment names Coutts and some NatWest business customers, not 6.4 million RBS customers.9

NatWest’s current biometric information: NatWest states that biometric identity can include fingerprints, face, and voice; that biometric identity is encrypted and stored in a NatWest database; and that it relies on legitimate interests for fraud-protection processing.33 This general policy does not name BioCatch or establish continuity of the historic BioCatch deployment.33

UK Israel Tech Hub accelerator cohort: A UK Israel Tech Hub notice recorded nine Israeli start-ups joining NatWest’s Entrepreneur/Fintech Accelerator: EasySend, Iagree, PayMe, Privacy Rating, Algosave, Valid Network, Cred, ForceNock, and Deceptive Bytes.29 ForceNock was described as providing API and web-asset protection, while Deceptive Bytes was described as endpoint-deception and ransomware-prevention technology.30 The programme was described as bank-funded and equity-free, offering support, potential office space, and opportunities to pitch to innovation teams.31, 34 NatWest’s current Accelerator description likewise presents coaching, masterclasses, networking, and hub-based entrepreneur support rather than vendor procurement.35

No public evidence identified that any of the nine accelerator participants was procured or deployed in NatWest, RBS, Coutts, or another group production environment.29, 31, 34, 35 The available evidence does not establish a contract date, deployment date, user scope, customer-data access, or production use for any participant.34, 35 BioCatch is separately documented as a direct 2016 deployment and is not established in the supplied evidence as an accelerator participant.9

No public evidence identified of NatWest deploying Israeli-origin facial recognition, voice biometrics, gait analysis, predictive policing, sentiment or social-media monitoring, workforce-surveillance tools, or physical branch-surveillance systems.14, 33

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

NatWest’s disclosed cloud and data stack includes AWS, Google Cloud, and IBM watsonx, all provided by US-headquartered companies.21, 24, 26, 27

NatWest’s 2025 Form 20-F identifies headquarters hubs in London and Edinburgh, operational sites in the UK and India, and data centres in Edinburgh and London.5 That disclosure does not identify an Israel office, data centre, or operational site.5

BioCatch’s current standard Data Processing Addendum states that BioCatch may use subprocessors for end-user data and that information on their locations and processing activities may be made available to subscribers.36 It provides for international transfers and includes an Israel-specific provision where a subscriber is located in Israel or end-user data is subject to Israeli privacy law; it does not state that a UK NatWest or Coutts deployment was processed in Israel.36 BioCatch’s general privacy notice states that information may be processed where BioCatch has facilities, personnel, or providers and may be accessible to authorities in those jurisdictions, but it is not NatWest-specific and does not establish NatWest’s actual data flows or legal-access arrangements.13

No public evidence identified that NatWest/Coutts behavioural or biometric data from the documented BioCatch deployment was stored in, routed through, processed in, or legally accessible from Israel, or that it entered an Israeli-controlled data or R&D pipeline.36, 13, 14 no public evidence identified that NatWest operates, leases, or co-locates data-centre infrastructure in Israel; participates in Project Nimbus; or provides Israeli state or military bodies with cloud, sovereignty, resilience, hosting, or data-residency services.5, 14

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of NatWest Group procuring technology from Israeli-domiciled defence or intelligence-sector vendors, including Elbit Systems, Rafael, Israel Aerospace Industries, or their subsidiaries.14

No public evidence identified that the documented NatWest/BioCatch relationship involved the Israeli Ministry of Defence, IDF, intelligence agencies, police, prison authorities, settlement bodies, or an occupied-territory operation.14, 9 BioCatch’s corporate history states that a co-founder previously served in military intelligence; this biographical background does not connect prior service to NatWest’s deployment, a government contract, or settlement-related use.14

No public evidence identified of NatWest technology contracts with Israeli state-security bodies, dual-use deployment in Israel or occupied territories, offensive-cyber activity, or purpose-built targeting or kinetic systems.14

NatWest has separately been documented as financing defence companies and, as of January 2021, holding more than £2.3 billion in outstanding loans or underwriting to companies with significant nuclear-weapons involvement under a policy permitting NATO-aligned producers.37 This is financial-relationship context rather than a technology-vendor relationship.37 PAX and BankTrack material concerning finance to arms-related companies is likewise not evidence of NatWest technology procurement, provision, or deployment.38, 39

NatWest has reported facing approximately 100 million cyber attacks per month, contributing to its investment in fraud and cybersecurity technology.40 Beyond BioCatch and the non-procurement accelerator cohort, the supplied evidence does not identify an Israeli-domiciled cybersecurity vendor operating in NatWest’s production security infrastructure.29, 14, 9

AI, Algorithmic & Autonomous Systems

NatWest’s documented AI portfolio is primarily based on US- and UK-domiciled providers.17, 19, 21, 22

No public evidence identified of NatWest deploying production AI or algorithmic systems from Israeli-domiciled vendors.14 no public evidence identified of NatWest providing AI/ML, computer vision, surveillance-derived training data, autonomous decision support, or autonomous target-generation systems to Israeli state, military, intelligence, security, or settlement actors.14

Technology Ecosystem & R&D Footprint

NatWest’s relationship with the UK Israel Tech Hub-facilitated accelerator cohort is documented as entrepreneurship support, mentoring, office-space access, networking, and opportunities to pitch innovation teams; it does not itself establish procurement, acquisition, investment, or production deployment.29, 31, 34, 35

NatWest collaborates with the University of Edinburgh on responsible AI and explainable machine learning.43 Mphasis has appeared in third-party digital-transformation ecosystem reporting; it is India-domiciled and is not an Israeli-domiciled entity.44

No public evidence identified of a NatWest Israeli R&D centre, Israeli engineering office, acquisition of an Israeli technology company, direct NatWest venture investment in an Israeli-domiciled technology company, or material co-development or patent arrangement with an Israeli entity or university.14 The parent company’s disclosed property locations identify UK and India sites rather than an Israel site.5

NatWest Group plc is registered in Scotland as company number SC045551, and NatWest Holdings Limited is the wholly owned holding company for the group’s ring-fenced bank businesses, including National Westminster Bank Plc, RBS plc, and Coutts & Company.1, 2, 3 NatWest Markets Plc and The Royal Bank of Scotland International (Holdings) Limited are also wholly owned subsidiaries of NatWest Group plc.2, 3

At 31 December 2025, NatWest’s notified holders above 3% were BlackRock, The Capital Group Companies, Massachusetts Financial Services Company, and Norges Bank; the cited annual report records no notified shareholder with 10% or more on the stated reporting basis.45 This notified-holdings disclosure does not establish beneficial ownership below reporting thresholds or changes after the reporting date.45 Targeted research identified no verifiable qualifying Israeli surveillance, cyber, AI, SIGINT, or military-technology investment by Paul Thwaite, Rick Haythornthwaite, or Katie Murray; that finding is limited to those named individuals and is not exhaustive for the board, executive committee, or associated vehicles.45

Civil Society Scrutiny & Regulatory History

In December 2021, the FCA fined National Westminster Bank plc £264,772,619.95 after convictions for three offences under the Money Laundering Regulations 2007, relating to failures associated with a customer relationship from November 2012 to June 2016.46, 47 The FCA described the proceedings as its first criminal charges for money-laundering failings.47 This enforcement action concerns AML controls and does not identify an Israeli technology vendor or Israel-linked technology service.47

NatWest is among the banks reported to have joined the FCA’s AI Live Testing scheme.42 no public evidence identified of ICO enforcement related to biometric-data processing in NatWest’s documented BioCatch deployment.14

The supplied document-scoped review found NatWest was not named in the 2023 OHCHR settlement-activity database update, the 2025 OHCHR update, or UN Human Rights Council report A/HRC/59/23; this is limited to those reviewed documents and is not a general finding about all relationships or databases.48, 9 PAX and BankTrack materials are financing-related civil-society leads and do not independently verify NatWest technology provision, procurement, or deployment.38, 39

No public evidence identified of an organised boycott or divestment campaign, legal action, export-control investigation, sanctions proceeding, or regulatory enforcement specifically concerning NatWest’s procurement or provision of Israeli-origin technology.14

Footnotes

  1. https://www.natwestgroup.com/hygiene/legal-information.html ↩ ↩2

  2. https://investors.natwestgroup.com/~/media/Files/R/RBS-IR-V2/annual-reports/ar-2025/additional-information-2025.pdf ↩ ↩2 ↩3

  3. https://www.natwestgroup.com/who-we-are/board-and-governance/our-subsidiaries.html ↩ ↩2 ↩3

  4. https://www.gov.uk/government/news/government-completes-exit-from-natwest - 2 ↩

  5. https://investors.natwestgroup.com/~/media/Files/R/RBS-IR-V2/results-center/13022026/20-f.pdf ↩ ↩2 ↩3 ↩4 ↩5

  6. https://www.computerweekly.com/news/366639140/NatWest-hails-progress-after-12bn-spent-on-tech-last-year-but-true-AI-transformation-to-come ↩

  7. https://www.prnewswire.co.uk/news-releases/natwest-deploys-biocatch-behavioural-biometrics-technology-to-help-combat-fraud-601547205.html ↩ ↩2

  8. https://www.biocatch.com/press-release/natwest-deploys-biocatch-behavioural-biometrics-technology-to-help-combat-fraud-1 ↩ ↩2 ↩3 ↩4 ↩5

  9. https://www.prnewswire.com/news-releases/natwest-deploys-biocatch-behavioural-biometrics-technology-to-help-combat-fraud-601547175.html ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13

  10. https://www.infosecurity-magazine.com/news/natwest-implements-behavioral/ ↩ ↩2

  11. https://findbiometrics.com/archive/uk-bank-behavioral-biometrics-311172/ ↩ ↩2

  12. https://www.biocatch.com/partners/better-together-with-microsoft ↩

  13. https://www.biocatch.com/privacy-policy ↩ ↩2 ↩3

  14. https://www.biocatch.com/company ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16

  15. https://www.cambridgenetwork.co.uk/directories/companies/1362/ ↩ ↩2

  16. https://www.featurespace.com/newsroom/natwest-and-featurespace-partner-for-real-time-enterprise-wide-fraud-prevention-and-transaction-monitoring1 ↩

  17. https://www.featurespace.com/newsroom/natwest-improves-scam-detection-rate-by-135-using-featurespaces-technology ↩ ↩2 ↩3

  18. https://www.featurespace.com/newsroom/natwest-best-innovation-by-financial-institution ↩

  19. https://a-teaminsight.com/blog/natwest-markets-chooses-dataikus-data-science-and-machine-learning-platform/ ↩ ↩2 ↩3

  20. https://www.prnewswire.com/news-releases/natwest-protects-customers-with-malwarebytes-premium-301139274.html ↩

  21. https://www.natwestgroup.com/news-and-insights/news-room/press-releases/innovation-and-partnerships/2023/nov/natwest-and-ibm-collaborateon-generative-ai-initiative-to-enhanc.html ↩ ↩2 ↩3 ↩4 ↩5

  22. https://www.natwestgroup.com/news-and-insights/news-room/press-releases/ai-and-data/2025/mar/natwest-open-ai-collaborate-to-accelerate-cutting-edge-ai-transf.html ↩ ↩2 ↩3 ↩4

  23. https://www.natwestgroup.com/news-and-insights/latest-stories/ai-and-data/2026/feb/being-a-trusted-partner-for-tomorrows-banking-through-technology.html ↩ ↩2

  24. https://www.natwestgroup.com/news-and-insights/news-room/press-releases/ai-and-data/2025/jul/natwest-group-to-accelerate-bank-wide-data-and-ai-transformation.html ↩ ↩2 ↩3

  25. https://www.natwestgroup.com/news-and-insights/news-room/press-releases/ai-and-data/2025/jul/natwest-group-to-accelerate-bank-wide-data-and-ai-transformation.html ↩ ↩2

  26. https://ffnews.com/newsarticle/natwest-markets-navigating-fast-changing-markets-and-regulations-in-real-time-on-google-cloud/ ↩ ↩2 ↩3

  27. https://cloud.google.com/customers/natwest-markets-dataplex ↩ ↩2 ↩3

  28. https://cloud.google.com/customers/natwest-markets-dataplex ↩ ↩2

  29. https://ukisraelhub.com/events/9-israeli-start-ups-join-natwests-fintech-accelerator/ ↩ ↩2 ↩3 ↩4 ↩5

  30. https://deceptivebytes.com/ ↩ ↩2

  31. https://ukisraelhub.com/events/the-natwest-entrepreneur-accelerator-is-looking-for-you/ ↩ ↩2 ↩3 ↩4

  32. https://investors.natwestgroup.com/~/media/Files/R/RBS-IR-V2/results-center/15-02-2019/management-presentation-15022019-v2.pdf ↩

  33. https://www.natwest.com/support-centre/general-banking-information/general/what-is-biometric.html ↩ ↩2 ↩3

  34. https://ukisraelhub.com/events/the-natwest-entrepreneur-accelerator-is-looking-for-you/ ↩ ↩2 ↩3 ↩4

  35. https://www.natwest.com/business/business-services/entrepreneur-accelerator.html ↩ ↩2 ↩3 ↩4

  36. https://www.biocatch.com/data-processing-addendum ↩ ↩2 ↩3

  37. https://natwest.dontbankonthebomb.com/ ↩ ↩2

  38. https://paxforpeace.nl/publications/the-companies-arming-israel-and-their-financiers/ ↩ ↩2

  39. https://www.banktrack.org/campaign/banktracks_human_rights_response_tracking_database ↩ ↩2

  40. https://dig.watch/updates/natwest-hit-by-100-million-cyber-attacks-every-month ↩

  41. https://www.natwestgroup.com/news-and-insights/latest-stories/ai-and-data/2025/may/upholding-ethical-use-of-ai-and-data-management.html ↩

  42. https://www.fstech.co.uk/fst/NatWest_Monzo_And_Santander_Amongst_First_To_Join_FCA_AI_Live_Testing_Scheme.php ↩ ↩2

  43. https://www.natwestgroup.com/news-and-insights/latest-stories/ai-and-data/2025/aug/empowering-ethical-ai-natwest-groups-learning-partnership-with-t.html ↩ ↩2

  44. https://www.businesswire.com/news/home/20251119603307/en/NatWest-Group-Digital-Transformation-Strategy-Report-2025 ↩

  45. https://investors.natwestgroup.com/~/media/Files/R/RBS-IR-V2/annual-report-2025/2025-annual-report-and-accounts.pdf ↩ ↩2 ↩3

  46. https://www.fca.org.uk/news/press-releases/natwest-fined-264.8million-anti-money-laundering-failures ↩

  47. https://www.fca.org.uk/news/press-releases/natwest-fined-264.8million-anti-money-laundering-failures ↩ ↩2 ↩3

  48. https://www.ohchr.org/en/hr-bodies/hrc/regular-sessions/session53/database-hrc5322 ↩