Digital Audit - NatWest Group plc

Domain: Digital / Technology Entity scope: NatWest Group plc and subsidiaries (NatWest, Royal Bank of Scotland, Coutts, Ulster Bank, NatWest Markets). UK Government residual shareholding is documented as historical shareholder-level context, attributed accordingly. Compiled: 2026-06-20 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

NatWest Group operates one of the UK’s most actively documented digital-transformation programmes, with a disclosed annual technology spend of £1.2 billion in 2025.¹

BioCatch (Israeli-domiciled - Tel Aviv): BioCatch, headquartered in Tel Aviv-Jaffa, Israel,² was deployed within NatWest Group from early 2016, initially within Coutts and with select business customers.³ The deployment captures over 500 behavioural data points - hand-eye coordination, pressure, hand tremors, navigation patterns, and scrolling - to perform continuous session authentication and detect fraud, remote-access trojans, and malware.⁴ NatWest’s then-Chief Administrative Officer endorsed the technology in the launch announcement, which listed a +972 (Israel) contact number.⁵ A planned 2017 pilot extension to personal-banking customers was announced at the time.⁶ No public evidence has been identified of a formal contract termination or renewal announcement as of June 2026; no updated public disclosure of continued or discontinued use post-2017 trial was located via live search.

Featurespace (UK-domiciled - Cambridge): NatWest’s primary fraud and transaction-monitoring platform is Featurespace’s ARIC platform, headquartered in Cambridge, UK.⁷ The partnership commenced in 2019⁸ and in February 2025 NatWest replaced its legacy fraud-risk and transaction-monitoring platform with the upgraded Featurespace Platform, reporting a 135% improvement in scam-detection rates and a 75% reduction in false positives.⁹ Featurespace is UK-domiciled and is not an Israeli-domiciled entity.¹⁰

Dataiku (US/French-domiciled): NatWest Markets selected Dataiku’s data-science and machine-learning platform in April 2020.¹¹ Dataiku is domiciled in New York / Paris and is not an Israeli-domiciled entity.

Malwarebytes (US-domiciled): NatWest Group partnered with Malwarebytes in September 2020 to provide endpoint protection to its retail and business customers across NatWest, Royal Bank of Scotland, Isle of Man Bank, NatWest International, and Ulster Bank.¹² Malwarebytes is US-domiciled.

IBM (US-domiciled): NatWest partnered with IBM in November 2023, using IBM’s watsonx platform to build Cora+, an upgraded generative-AI digital assistant launched in June 2024.¹³

OpenAI (US-domiciled): In March 2025, NatWest became the first UK-headquartered bank to partner directly with OpenAI, extending its Cora assistant to agentic capabilities.¹⁴ As of Q1 2026, 25,000 customers had access to the agentic financial assistant within Cora.¹⁵

AWS / Accenture (US-domiciled): In July 2025, NatWest announced a five-year collaboration with AWS and Accenture to accelerate bank-wide data, analytics, and AI transformation.¹⁶

Google Cloud (US-domiciled): NatWest Markets migrated risk platforms and data-processing workloads to Google Cloud, including BigQuery, training 1,100 employees on Google Cloud Platform by 2021.¹⁷

No public evidence identified of NatWest Group deploying NICE Actimize (NICE Ltd, Israeli-domiciled, Ra’anana), Check Point, CyberArk, Pagaya, Forter, or Riskified in its own production stack.

Surveillance, Biometrics & Retail Technology

BioCatch behavioural biometrics: The confirmed deployment of BioCatch - an Israeli-domiciled company (Tel Aviv-Jaffa, founded 2011)² - within Coutts and NatWest business banking from 2016 represents the primary documented instance of Israeli-domiciled technology in the NatWest stack.³⁴ The technology functions as passive biometric profiling of customer behaviour throughout digital-banking sessions, building unique profiles used to flag anomalies.

UK Israel Tech Hub accelerator cohort (Israeli-domiciled fintechs): A UK Israel Tech Hub event documented nine Israeli-domiciled start-ups joining NatWest’s Entrepreneur/Fintech Accelerator.¹⁸ Among these were two Israeli cybersecurity / fraud-adjacent companies: ForceNock (API and web-asset protection) and Deceptive Bytes (endpoint deception / ransomware prevention, Tel Aviv).¹⁹ Others included Algosave (ML credit-risk analytics), Valid Network (blockchain security), and Privacy Rating (data-leakage prevention).¹⁸ The accelerator is described as equity-free and bank-funded, offering office space and access to the bank’s innovation networks.²⁰ No public evidence identified that any of these nine Israeli companies progressed to live procurement or operational deployment within NatWest’s production systems.

No public evidence identified of NatWest deploying facial recognition, voice biometrics from an Israeli-domiciled vendor, or any Israeli-domiciled physical-surveillance vendor in its branch network.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

NatWest operates a multi-cloud strategy across US-headquartered hyperscalers. The confirmed cloud footprint comprises:

• AWS - primary strategic partner from July 2025 (five-year deal with Accenture) for bank-wide data-platform consolidation and AI.¹⁶
• Google Cloud - NatWest Markets uses Google Cloud (BigQuery, Kubernetes Engine, Dataplex) for risk platforms and data management.¹⁷²¹
• IBM watsonx - used for the Cora+ AI assistant.¹³

All confirmed cloud-infrastructure providers are US-domiciled. No public evidence identified of NatWest using Israeli-domiciled cloud or sovereign-cloud services, nor of any UK government sovereign-cloud arrangement involving Israeli-domiciled infrastructure in the NatWest context.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of NatWest Group procuring technology from Israeli-domiciled defence or intelligence-sector technology vendors (e.g. Elbit Systems, Rafael, IAI, or subsidiaries).

NatWest has separately been documented as financing defence companies and, as of January 2021, holding over £2.3 billion in outstanding loans or underwriting to companies with significant nuclear-weapons involvement under a policy permitting NATO-aligned producers.²² This is financial-relationship context, not a technology-vendor relationship, and is addressed in the Military audit rather than here.

NatWest is documented as facing approximately 100 million cyber attacks per month, which has driven its investment in fraud and cybersecurity technology.²³ No evidence that Israeli-domiciled cybersecurity vendors (beyond the BioCatch biometrics deployment and the accelerator cohort) are operationally deployed in NatWest’s production security infrastructure.

AI, Algorithmic & Autonomous Systems

NatWest’s AI portfolio is extensive and primarily built on US/UK-domiciled vendor platforms:

• Cora / Cora+ - digital assistant originally launched 2017; upgraded with IBM watsonx to Cora+ in June 2024;¹³ further upgraded with OpenAI agentic capabilities targeting 25,000 customers by end Q1 2026.¹⁴¹⁵
• AskArchie+ - internal employee-facing chatbot, OpenAI-powered.¹⁴
• Featurespace Platform - ML-based fraud and scam detection deployed bank-wide from February 2025.⁹
• Dataiku - self-service ML for NatWest Markets front office (from 2020).¹¹
• Responsible-AI framework - NatWest published an AI and Data Ethics Code of Conduct, established an AI Research Office, and participates in the FCA’s AI Live Testing scheme.²⁴²⁵ It maintains a responsible-AI learning partnership with the University of Edinburgh.²⁶

No public evidence identified of NatWest deploying AI or algorithmic systems from Israeli-domiciled vendors in production. The Featurespace fraud-detection ML system is UK-domiciled.

Technology Ecosystem & R&D Footprint

UK Israel Hub accelerator engagement: NatWest has an established relationship with the UK Israel Tech Hub, which facilitated a cohort of nine Israeli start-ups entering NatWest’s Entrepreneur/Fintech Accelerator programme.¹⁸²⁰ The accelerator is equity-free and involves office space, mentoring, and connections - it does not, on its face, constitute a procurement or deployment relationship.

University of Edinburgh partnership: NatWest collaborates with the University of Edinburgh on responsible AI and explainable machine learning.²⁶

NatWest Ventures: No public evidence identified of direct venture investments by NatWest into Israeli-domiciled technology companies.

Mphasis: Referenced in third-party digital-transformation ecosystem reports as a technology partner;²⁷ Mphasis is India-domiciled (Bengaluru) and is not an Israeli-domiciled entity.

Civil Society Scrutiny & Regulatory History

FCA AML fine (2021): In December 2021, the FCA fined National Westminster Bank plc £264.8 million for breaches of the Money Laundering Regulations 2007 - the first criminal prosecution of a UK bank under those regulations.²⁸ The FCA identified failures in automated transaction-monitoring systems. NatWest subsequently invested heavily in its fraud and AML technology stack, including the Featurespace deployment.

FCA AI Live Testing: NatWest is among the first banks - alongside Monzo and Santander - to participate in the FCA’s AI Live Testing scheme.²⁵

Nuclear-financing campaigns: Civil society organisations (ICAN, Don’t Bank on the Bomb) have campaigned against NatWest’s financing of nuclear-weapons companies; this is a financial-relationship issue addressed under Military.²²

No public evidence identified of civil society campaigns specifically targeting NatWest’s procurement of Israeli-domiciled technology vendors, nor of any ICO enforcement action related to biometric-data processing in NatWest’s deployment of BioCatch.

End Notes