B&M Digital Audit

Target Entity: B&M European Value Retail S.A. (LSE: BME); operating subsidiaries B&M Retail Ltd (UK), Heron Foods Ltd, B&M France SAS
Audit Phase: V-DIG
Audit Date: 2026-05-01
Jurisdiction of Incorporation: Luxembourg (S.A.); principal operations England & Wales

Enterprise Technology Stack & Vendor Relationships

Identity, Access Management & Cybersecurity

B&M Retail Ltd’s confirmed enterprise identity and access management (IAM) provider is Cisco Duo, which supplies multi-factor authentication (MFA) across the B&M UK store estate and corporate network. A named vendor case study published on the Duo Security resources portal documents B&M as a customer, describing Duo’s deployment in an “identity first” security model across the organisation ³. Cisco (Duo’s parent since its 2018 acquisition) maintains significant Israeli R&D operations through past acquisitions, but Duo Security is a US-origin product line (Ann Arbor, Michigan) with no identified Unit 8200 lineage or Israeli-origin technology component within the platform as deployed at B&M.

No public evidence has been identified of B&M holding licensing, subscription, or integration relationships with any of the following Israeli-origin cybersecurity vendors: Check Point Software, Wiz, SentinelOne, CyberArk, Palo Alto Networks (Israeli R&D), Claroty, or Armis. This absence is consistent across B&M’s annual report disclosures, trade press coverage, and vendor case study material reviewed for this audit.

Payment Infrastructure

B&M’s payment security architecture, as described in its 2020 and 2021 Annual Reports, is built around Worldpay (FIS) point-to-point encryption (P2PE) at the PIN entry device layer, supporting PCI DSS compliance obligations across the UK estate ^{15 16}. Worldpay is a US/UK-origin financial infrastructure provider with no identified Israeli-origin technology component in the payment stack as deployed at B&M. No evidence of B&M using Israeli-origin payment processing, fraud detection, or financial compliance technology has been identified.

Systems Integration & Retail Operations Technology

TPP Retail (a UK-based retail software house) is B&M’s primary systems integrator for store operations technology. In November 2023, trade press reported the rollout of TPP’s retail operations platform across B&M’s UK estate ¹, subsequently confirmed by a TPP Retail vendor case study ² and a B&M-specific case study page on TPP’s website ⁸. TPP’s engagement encompasses:

• Zebra Technologies TC21 Android handheld terminals for stock management, ordering, and store operations across the UK estate ^{8 33}. Zebra Technologies is US-origin (Lincolnshire, Illinois).
• Proprietary TPP store operations software, integrated with B&M’s back-office systems.

TPP Retail’s documented technology stack centres on Zebra hardware and its own software; no Israeli-origin technology has been identified as mandated or deployed by TPP in the B&M engagement.

Subsidiary IT — Heron Foods

Claranet (a UK-based managed services provider) supplies managed IT and PCI DSS compliance services to Heron Foods Ltd, a B&M subsidiary. A Claranet case study confirms this relationship and describes its scope in terms of network management and security compliance ⁴. Claranet is a UK/European MSP with no Israeli-origin technology identified in the Heron Foods engagement. The sub-contractor technology stack deployed by Claranet within the Heron Foods managed service could not be independently verified from available evidence and is identified as an evidence gap requiring live verification.

Document & Records Management

A Ricoh UK vendor case study documents B&M’s use of DocuWare (a document management platform) for digital document management, covering HR processes and back-office workflows ¹⁴. DocuWare is a German-origin software product, since acquired by Ricoh. No Israeli-origin component has been identified in this engagement.

Logistics Infrastructure

In October 2025, Iron Mountain announced a 10-year contract logistics partnership with B&M, covering document and data management logistics across the UK operation ¹³. Iron Mountain is a US-origin firm (Boston, Massachusetts). The contract covers UK logistics operations and has no identified Israeli-origin technology component.

Cloud & Software-as-a-Service

B&M’s annual reports do not name specific cloud infrastructure providers beyond generic references to digital transformation. No evidence has been identified of B&M holding a direct commercial relationship with any Israeli-origin cloud or SaaS platform. The absence of publicly named cloud providers in B&M’s disclosures limits the depth of analysis available without live verification of current job postings and procurement records.

Surveillance, Biometrics & Retail Technology

Live Facial Recognition — Facewatch

B&M Retail Ltd is a confirmed, named subscriber to the Facewatch live facial recognition (LFR) watchlist system — the most significant surveillance technology finding in this audit. The evidential basis for this finding is multi-source and robust:

• B&M’s own privacy policy names Facewatch as a data controller for biometric data collected at store entrances, confirming a live commercial relationship ¹².
• B&M is named as a Facewatch user in Big Brother Watch’s October 2022 report “Who’s Watching? Facial Recognition in UK Retail”, which identifies B&M alongside Southern Co-op as among the most aggressive retail deployers of LFR watchlist technology in the UK ²². The accompanying Big Brother Watch campaign page reiterates this finding ²¹.
• In November 2025, Biometric Update reported a specific incident involving a wrongful identification at a B&M store using the Facewatch system — a named customer wrongly flagged as a subject of interest — with human error cited in the system’s response protocol ⁹.
• The July 2023 controversy surrounding Facewatch’s closed-door meeting with the UK Home Office, reported by Biometric Update, explicitly referenced Facewatch’s retail client base, including B&M, in the context of governance and transparency concerns ^{10 11}.
• A B&M internal data privacy notice archived via Scribd (document reference 004) further references biometric data processing consistent with the Facewatch deployment ²⁴.

Facewatch’s corporate origin and technology: Facewatch Ltd is a UK-domiciled company incorporated in England and Wales. It is not an Israeli-origin firm. Its operational model involves capturing facial images at store entrances, converting them to biometric templates, and matching against a cloud-hosted shared watchlist of persons of interest contributed by subscribing retailers ²⁰. The algorithmic providers used by Facewatch in the B&M deployment period are reported in trade press as including Amazon Rekognition (an AWS cloud computer vision service, US-origin) and, in earlier periods, RealNetworks SAFR (a US-origin, Seattle-based facial recognition platform). Neither is Israeli-origin.

Governance structure: B&M, as a Facewatch subscriber, is not the data controller for the biometric processing; Facewatch Ltd holds that role. B&M is the data processor/subscriber. This structure means B&M has delegated decisions about algorithmic providers and data infrastructure to Facewatch. The consumer press has raised concerns about whether this delegation is adequately disclosed to shoppers ²⁹.

No Israeli-origin facial recognition technology identified: No public evidence has been identified that Facewatch uses algorithms from AnyVision/Oosto, BriefCam, Trigo, Corsight AI, or any other Israeli-origin facial recognition vendor in its B&M deployment. The AnyVision-to-Oosto rebrand occurred in 2022 ³¹; no relationship between Oosto and Facewatch or B&M has been identified.

Other Computer Vision & Analytics

• Trigo: No public evidence identified of B&M deploying Trigo’s autonomous checkout computer vision system. Trigo’s confirmed UK deployments are with Co-op Food; its European deployments are with REWE. B&M’s store format and value-retail cost model are structurally inconsistent with Trigo’s infrastructure requirements, which involve dense camera arrays and edge compute at shelf level.
• Trax: No verified evidence identified. A keyword association in the Scribd-archived B&M document ²⁴ is assessed as a likely false positive. No training-data knowledge supports a B&M–Trax relationship.
• Hanshow Electronic Shelf Labels (ESL): A July/August 2023 food-to-go trade magazine reference documents a Heron Foods deployment of Hanshow electronic shelf label systems ¹⁹. Hanshow is a Chinese-origin company (Beijing headquarters) and the finding, while consistent with Hanshow’s UK market activity in this period, rests on a single trade source and could not be independently confirmed from a second source. This should be treated as plausible but unconfirmed pending live verification.

Electronic Article Surveillance

B&M uses Sensormatic electronic article surveillance (EAS) systems — traditional RF/RFID anti-theft tags — as part of its standard loss prevention infrastructure ³². Sensormatic is a Johnson Controls brand, US-origin (Princeton, New Jersey). It is not Israeli-origin.

Fleet Telematics & Driver Monitoring

B&M is a confirmed customer of VUE Group (Vision Unique Equipment) for video telematics across its logistics fleet. VUE vendor case studies document the B&M relationship, covering VMC4 connected telematics units for claims management and driver behaviour monitoring ^{5 6}. A VUE Group press release records a partnership between VUE and Radius Payment Solutions ⁷; however, the characterisation of this as a full acquisition (VUE by Radius) reported in trade press ²⁵ could not be independently confirmed from training data, and is flagged as unverified. The distinction is material: if VUE was acquired by Radius, B&M’s fleet telematics supply chain passes through the Radius corporate group.

A further claimed supply-chain link — that Radius Telematics integrates Mobileye (Israeli-origin, Jerusalem; acquired by Intel in 2017 ²⁶) EyeQ collision avoidance technology into its platform, and that this technology is present in B&M’s VUE fleet units — is assessed as plausible in structure but unverified at each link. Mobileye maintains fleet safety partnerships distributed through telematics platform integrators, and its fleet product range is publicly documented. However, whether Radius is among these integrators, and whether B&M’s specific VUE units incorporate Mobileye hardware or software, cannot be confirmed from available evidence. This chain (B&M → VUE → Radius → Mobileye) is identified as a priority evidence gap requiring live verification before it can be presented as a finding rather than a hypothesis.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

B&M’s Operational Geography

B&M has no operational presence in Israel or the Middle East. Annual reports confirm operations in the United Kingdom, Republic of Ireland, and France only ^{15 16 17}. No data centre, distribution centre, or registered office is located in Israel or any Israeli-administered territory.

Project Nimbus — No Direct Participation

No public evidence has been identified of B&M participating in, contracting under, or otherwise engaging with Project Nimbus — the approximately USD 1.2 billion Israeli government cloud infrastructure contract awarded jointly to Amazon Web Services and Google Cloud in 2021 ²⁷. B&M is not a party to this contract and is not a technology provider to the Israeli state.

A tertiary commercial inference was noted in preparatory research: B&M’s technology vendors (including Facewatch, which likely uses AWS infrastructure, and VUE, whose cloud backend provider is unconfirmed) may themselves use AWS, and AWS participates in Project Nimbus ²⁸. This represents a relationship mediated by at least two independent commercial parties and is not characterised as a finding of B&M participation in or material contribution to Project Nimbus. The inference is recorded for completeness but does not constitute an evidenced finding.

Data Residency

No public evidence has been identified of B&M’s customer or operational data being stored in Israel or processed by Israeli-domiciled data infrastructure providers. B&M’s privacy policy ¹² identifies Facewatch as the biometric data controller; Facewatch’s data infrastructure location is not publicly specified in available sources, and the current algorithmic provider (Amazon Rekognition or otherwise) may process biometric data in AWS regions outside the UK. The data residency implications of Facewatch’s infrastructure choices are delegated from B&M to Facewatch as data controller.

Sovereign Cloud Participation

B&M does not provide cloud, data sovereignty, or infrastructure resilience services to any government or third party. It is a retail end-user of such services, not a provider. No evidence of participation in any sovereign cloud programme — UK or otherwise — has been identified.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence identified. B&M European Value Retail S.A. and its subsidiaries are engaged exclusively in discount variety retail operations. No defence, intelligence, or national security sector contracts have been identified in any jurisdiction. Annual reports, regulatory filings at Companies House ³⁰, and S&P Global credit analysis ¹⁸ confirm no material revenue streams from non-retail activities.

Dual-Use Technology Provision

No public evidence identified. B&M does not develop, manufacture, or supply technology products. It is a consumer retail end-user of technology. No dual-use goods, export-controlled technology, or military-grade equipment has been identified in B&M’s product offering or supply chain at the corporate level.

Offensive Cyber & Weapons Technology

No public evidence identified. No relationships with offensive cyber capability developers, weapons systems integrators, or munitions manufacturers have been identified in any available source.

Intelligence Community Relationships

No public evidence identified. The July 2023 Facewatch/Home Office closed-door meeting reported by Biometric Update ¹⁰ involved Facewatch Ltd’s engagement with the UK Home Office on the governance of retail facial recognition — this is a domestic UK regulatory engagement involving B&M’s supplier, not B&M itself, and does not constitute an intelligence community relationship for B&M.

AI, Algorithmic & Autonomous Systems

AI/ML Systems Provision

No public evidence identified. B&M does not develop, supply, license, or operate AI or machine learning systems for any state body, public authority, or third party. It is a retail operating company with no identified AI product development capability.

Algorithmic Decision-Making in Operations

The Facewatch LFR system deployed at B&M stores involves algorithmic biometric matching. As documented above, B&M is the subscriber and Facewatch Ltd is the data controller and system operator. The algorithm itself (Amazon Rekognition or prior iterations using RealNetworks SAFR) is procured and operated by Facewatch, not by B&M. B&M’s role is limited to providing access to store premises and contributing to the shared watchlist of persons of interest. The Biometric Update reporting on the November 2025 wrongful identification incident illustrates the operational consequences of algorithmic error rates in this deployment context ⁹.

No other algorithmic or automated decision-making system with material civil liberties, dual-use, or Israel-nexus implications has been identified in B&M’s operational stack.

Training Data & Model Development

No public evidence identified. B&M has no identified involvement in AI training data generation, sale, or licensing. No relationship with AI model development organisations — commercial or state-affiliated — has been identified.

Autonomous Systems

No public evidence identified. B&M has not deployed autonomous vehicle, drone delivery, autonomous fulfilment, or robotics systems at any verified operational scale. No lethality-relevant autonomous system involvement of any kind has been identified.

Technology Ecosystem & R&D Footprint

R&D Operations

B&M has no R&D operations in Israel. Its technology and digital functions are based at the company’s UK headquarters in Speke, Liverpool. Annual reports make no reference to engineering offices, innovation labs, accelerator programmes, or technology partnerships with Israeli research institutions ¹⁷. B&M does not self-describe as a technology company and does not publish R&D expenditure figures; technology deployment is managed through vendor relationships rather than in-house development.

Acquisitions & Investments

No public evidence identified of B&M acquiring or investing in any Israeli-origin technology company, Israeli technology venture fund, or Israel-focused technology accelerator. B&M’s documented corporate acquisitions are:

• Heron Foods (UK grocery discount chain), acquired 2017.
• Babou (French discount retailer), acquired 2018, subsequently partially disposed of ¹⁷.

Neither acquisition has any identified Israeli technology dimension. B&M’s capital allocation strategy, as described in annual reports and S&P credit analysis ¹⁸, is focused on organic store-estate expansion and operational efficiency rather than technology M&A.

Patent & Intellectual Property

No public evidence identified of patent filings, licensing agreements, or co-development arrangements between B&M and any Israeli-domiciled entity, including Israeli universities (Technion, Hebrew University, Ben-Gurion University, Weizmann Institute) or Israeli state research bodies. B&M does not hold a material patent portfolio; as a retail operating company, its competitive advantages are operational and commercial rather than IP-based.

Technology Partner Ecosystem

B&M’s confirmed technology partner ecosystem, drawn from vendor case studies and trade press, comprises:

• Cisco Duo — IAM/MFA (US) ³
• TPP Retail — store operations systems integrator (UK) ^{1 2 8}
• Zebra Technologies — handheld terminals (US) ³³
• Claranet — managed IT/PCI DSS for Heron Foods (UK/EU) ⁴
• Ricoh / DocuWare — document management (Japan/Germany) ¹⁴
• Facewatch — live facial recognition watchlist (UK) ¹²
• Sensormatic / Johnson Controls — electronic article surveillance (US) ³²
• VUE Group — fleet video telematics (UK) ^{5 6}
• Iron Mountain — contract logistics (US) ¹³
• Hanshow — electronic shelf labels at Heron Foods (China; single-source, unconfirmed) ¹⁹
• Worldpay / FIS — payment P2PE (US/UK) ¹⁵

No Israeli-origin vendor has been confirmed in a direct or first-tier supply relationship with B&M or any of its subsidiaries.

Civil Society Scrutiny & Regulatory History

NGO & Civil Society Reports

Big Brother Watch is the principal civil society organisation to have specifically named and documented B&M’s use of facial recognition technology. Its October 2022 report “Who’s Watching? Facial Recognition in UK Retail” named B&M Retail alongside Southern Co-op as among the most significant retail deployers of Facewatch live facial recognition in the UK ²². The accompanying campaign page reiterates this finding and calls for regulatory intervention ²¹. The report raises concerns about:

• The deployment of biometric surveillance on a customer base disproportionately drawn from lower-income demographics, given B&M’s value retail positioning.
• The adequacy of customer notice and consent under UK GDPR.
• The shared watchlist model and the conditions under which individuals are added to and removed from the watchlist.

Big Brother Watch does not, in the sources available for this audit, characterise B&M’s technology use as connected to Israeli state infrastructure or Israeli occupation.

Biometric Update has provided the most detailed trade-press coverage of B&M’s Facewatch deployment, including:

• Reporting on the July 2023 controversy surrounding Facewatch’s engagement with the UK Home Office on retail LFR governance ^{10 11}.
• Reporting on the November 2025 wrongful identification incident at a B&M store, including B&M’s public response attributing the failure to human error in the response protocol rather than algorithmic failure ⁹.

Which? (UK consumer champion) has reported on facial recognition in retail shops and has addressed the Facewatch/B&M relationship in the context of consumer rights and transparency ²⁹.

No NGO, academic report, or civil society publication identified for this audit characterises B&M’s retail technology as connected to Israeli state entities, Israeli occupation infrastructure, or Israeli defence or intelligence bodies.

Boycott, Divestment & Sanctions Campaigns

No public evidence identified of any organised boycott, divestment, or sanctions (BDS) campaign targeting B&M specifically on grounds of its technology relationships with Israeli state entities or Israeli-origin technology vendors. BDS movement campaign records reviewed in training data do not surface B&M as a named technology-sector target. B&M does not stock Israeli-branded goods as a known product line in the manner that has made some retailers targets of BDS product boycotts, and no technology-focused BDS campaign naming B&M has been identified.

Regulatory & Legal Actions

ICO reprimand to Facewatch and Southern Co-op (October 2022): The UK Information Commissioner’s Office issued formal reprimands to Facewatch Ltd and Southern Co-op in October 2022, following an investigation into their use of live facial recognition in retail stores ²³. The ICO found concerns regarding whether the processing met the lawfulness, fairness, and transparency requirements of UK GDPR and the Data Protection Act 2018. B&M was not named as a respondent in this action. However, B&M is a Facewatch subscriber using the same system architecture and shared watchlist model that formed the subject of the reprimand. The ICO reprimand established that the Facewatch model in its then-current form presented compliance risks under UK data protection law.

No data protection enforcement action by the ICO specifically naming B&M Retail Ltd or any B&M subsidiary in connection with Facewatch or any other technology system has been identified in available training-data knowledge.

No regulatory inquiry, export control action, financial sanctions investigation, or legal challenge involving B&M’s technology relationships with Israeli state entities or Israeli-origin technology vendors has been identified.

S&P Global CreditWatch: In 2025, S&P Global Ratings placed B&M’s credit rating on CreditWatch Negative following a profit warning that included disclosure of an accounting error ¹⁸. This is a financial, not a technology or regulatory, finding. It is noted for contextual completeness regarding corporate governance posture.

Companies House filings: B&M’s UK operating entities are registered at Companies House and are current with their filing obligations ³⁰. No technology-related legal proceedings are disclosed in available filings.

End Notes