The Banks Shared Their Risk Playbooks - and Acin Built the Index

A bank can tell you how it handles a fat-fingered trade, a cyber intrusion or a rogue employee. Ask whether those controls are complete, plainly written and better than its peers', and the answer gets foggier. For decades, operational risk was documented in local dialects: sprawling spreadsheets, duplicated controls, prose written by different teams and taxonomies that stopped at departmental borders. The comparison set was usually yesterday's version of the same bank.

Acin's wager was that this dull-looking data problem could support an industry utility. The London company collected risk-and-control inventories, normalized the language and returned a private comparison against an anonymized network. Its customers could see where they matched common practice, where they were unusual and where something might simply be missing. The bargain was crisp: give data to get intelligence.

The first failure was the dictionary

Founder Paul Ford knew the inside of the machine. A former Royal Engineers officer, he moved through Accenture, Barclays Wealth and Credit Suisse before founding operational-risk consultancy Anchura Partners in 2010. By the time he exited that business to start Acin in 2018, he had watched financial institutions attack the same problem with large teams and incompatible language.

The old method failed first at the data layer. One desk's “control” might be another desk's procedure. The same safeguard could appear several times under slightly different names, while a genuine gap hid in the noise. A traditional governance, risk and compliance system could store the entries, but storage did not make them comparable. Manual cleanups were slow, expensive and obsolete soon after completion.

Acin did not begin by promising an oracle. It built a common reference library. Client data was ingested from GRC platforms and the stranger corners where controls lived, mapped into a standard structure, checked for quality and connected to an industry index. Risk teams gained a single view without necessarily ripping out their systems of record.

“Going it alone isn't the solution.” The network made other banks' experience part of the product.

The customers became the cap table

This is where Acin separates from a generic risk dashboard. Banks compete for clients and talent, but operational failure is mostly shared pain. A broken control does not produce a better bond desk; it produces losses, remediation and uncomfortable meetings with regulators. In 2022, Acin's technology chief Graeme Wynn made the case directly: operational risk is a cost business, and one bank's failure can spill into another.

The network needed trust, so proof arrived slowly. J.P. Morgan piloted Acin inside a subset of its trading business for two years. In 2021 it expanded the platform across Global Markets, using peer benchmarks alongside its established risk processes. That is the moment worth noticing. A cautious buyer did not have to replace its machinery or surrender judgment. It widened a tested comparison tool.

Then customers crossed to the ownership side. J.P. Morgan, Citi, BNP Paribas, Barclays and Lloyds Banking Group participated in Acin's $24 million Series B in December 2022, with Notion Capital, Talis Capital and Fitch Ventures. The round followed a $12 million Series A led by Notion in 2020. Five major banks investing together was more than a financing event. It was an endorsement of the shared standard.

AI arrived after the cleanup

Once controls were structured, software could do more than display them. Acin's quality tooling assessed wording, identified proliferation and helped write or optimize controls. Regulatory mapping connected obligations to the processes, risks and safeguards meant to satisfy them. Dynamic risk intelligence added alerts and scenarios. The platform became available through Microsoft Azure Marketplace in July 2024, reducing procurement and deployment friction for cloud customers.

The company's sharpest numerical claim comes from an unnamed global bank. Faced with more than 20,000 controls, the client used Acin's Rewrite Tool to standardize the framework. Acin said a job that represented roughly 30 years of aggregate human effort was reduced to a few months, with £4.3 million in projected staff-cost savings. Because the customer is not identified and the figure is a projection, it should be read as a vendor case study, not an audited universal result. Still, it gives the abstraction a price tag.

The tool works best under particular conditions: control data can be securely ingested, leaders accept a shared taxonomy, peer coverage is relevant and subject-matter experts remain in the loop. It is less persuasive for a small firm with few controls, a highly idiosyncratic risk profile or policies that prevent participation in an aggregated network. Bad inputs remain bad inputs, only faster. Acin itself says AI alone is not the solution.

CUBE buys the missing half

CUBE acquired Acin on June 19, 2025. The price was not disclosed. The strategic logic was easier to see than the transaction math. CUBE already tracked regulatory change - the laws, rules, publications and obligations moving across jurisdictions. Acin knew the other end of the chain - the controls inside a financial institution and how those controls compared with peers.

Put together, the companies could trace a line from a new rule to an obligation, from that obligation to a process and control, and from that control to an industry benchmark. CUBE called the combined destination RegPlatform. It also announced a broader collaboration supported by the five bank investors, aiming to automate mapping, improve traceability and extend opt-in anonymized analytics.

Acin joined a much larger operation. At the announcement, CUBE said it served 1,000 customers and employed 700 people across 20 countries. Ford moved to an advisor role, while Wynn later became CUBE's executive head of AI and data, responsible for combining public regulatory data with Acin's proprietary operational-risk data. Acin's identity remained visible, but its network had become infrastructure inside a broader compliance stack.

A playbook others can copy

The useful lesson is not “add AI to compliance.” Acin's sequence was more disciplined. It chose a costly workflow that customers did not regard as competitive advantage. It recruited credible institutions early. It normalized the raw material before automating it. It returned a benchmark that improved as participation grew. Finally, it kept practitioners beside the models, because a beautifully worded control can still be the wrong control.

There is also a sales lesson in J.P. Morgan's two-year pilot. Network products often die because the first participant gets an empty room. Acin found value before full scale through data cleanup, diagnostics and a reference library, then made the comparison richer as more banks joined. The product did not ask a risk chief to believe in industry transformation on day one. It asked for one bounded deployment.

Acin sits between GRC systems, consultants and regulatory-intelligence platforms. ServiceNow, MetricStream, Archer and IBM OpenPages can manage broad governance workflows; internal teams and advisers can remediate frameworks; CUBE and other RegTech providers track regulatory change. Acin's claim to distinctiveness is narrower: a standardized, cross-institution view of operational controls that can enrich those systems rather than automatically replace them.

For a risk manager, that means fewer scavenger hunts. A team can pull several inventories into one view, spot controls that say the same thing, test coverage against a regulatory obligation and decide where remediation deserves attention first. Executives get evidence for a board or regulator instead of a heroic spreadsheet reconciliation. The network does not make the decision for them. It changes the starting point from “this is how we have always written it” to “this is how our framework compares.” In a field built around proving that reasonable steps were taken, a documented comparison can be as valuable as another prediction.

The company began with an unglamorous observation. Banks had plenty of risk data, but little of it could speak to the rest. Seven years later, a larger software group bought the translator. The grand promise is safer finance. The practical product is more modest and perhaps more believable: fewer duplicate controls, clearer gaps, better evidence and a way to know when “good enough” is merely local folklore.