Sardine vs Variance (2026)

Agents are described as integrated with the customer's data and compliance workflows, and they research businesses across registration records, filings, licenses and online sources. The platform returns decisions and routes cases through its own case management, and the customer integrates by calling Sardine through its SDK and API. Sardine's public pages show no catalog of connectors into third party systems and no framework for customers to add tools, and the integration guides sit behind the documentation login.

SourceSardine, sardine.ai/agentic-ai-for-aml and docs.sardine.airead 2026-09-06

The tool catalog has named entries across seven categories. They include sanctions screening across 1,400-plus programs, PEP screening, adverse media in 30-plus languages, litigation and dockets, UBO enrichment, device and IP intelligence, corporate registries individually listed across 50-plus jurisdictions with the countries named, and a suite of verification tools. A named Snowflake connector retrieves from the customer's own databases, and a full integration list is available on request.

SourceVariance, variance.com/product/toolsread 2026-09-07

Agents are composed for each workflow. Alert reviews run the Doc KYC, PEP Screening, OSINT Search and Sanctions Screening agents together, business verification runs Business Due Diligence, OSINT, Graph Analyst and Doc KYC, and the Data Analyst and Rule Assistant agents pair on rule creation. Rules, workflows and case management route cases and follow ups, and a customer testimonial describes the system triaging alerts, opening cases and routing follow ups automatically. Customers get a rules and workflow builder for this multi agent, multi step work.

SourceSardine, sardine.ai/agentic-ai-for-aml and sardine.airead 2026-09-06

Customers compose their own investigative agents and encode their own workflows. The platform offers first-party tools for custom investigative agents, and customers compose agents from the catalog. The SOP layer encodes any investigative workflow in plain language for consistent, traceable execution. A full investigation runs end to end through evidence pull, ownership tracing, screening, and a structured Decision plus Evidence Pack, and a second agent monitors continuously.

SourceVariance, variance.com/product/toolsread 2026-09-07

Events inside the platform hand work to the agents. Transaction monitoring, sanctions, PEP and KYC alerts generated by the rules engine and screening are handed to the agents for triage, onboarding applications submitted through the customer's integration are reviewed in real time, and rules fire on transactions across onboarding, login and payment flows. Customer testimonials describe alerts handed off automatically in real time. Starts are event driven, from the platform's own detection and the web application. The public pages show no schedule or webhook surface a customer can configure.

SourceSardine, sardine.ai/agentic-ai-for-aml and sardine.airead 2026-09-06

Two kinds of trigger exist. Investigations start from alerts in transaction monitoring, and the continuously monitoring second agent surfaces relationships outside predefined rules, with SIEM export as the outbound path. There is no trigger surface customers configure, no schedule, no event subscription and no channel beyond the application, and Variance does not say which events can start an investigation or where results can go besides the SIEM.

SourceVariance, variance.com/solutions/transaction-monitoring and variance.com/securityread 2026-09-07

The platform maintains a connections graph mapping relationships between users, devices, IP addresses, phones, emails and transactions that the Graph Analyst Agent queries to surface mule rings and relationships. It also keeps a case store holding customer history and prior findings the agents draw on, and consortium fraud intelligence across billions of devices. These persist, scale past a context window and stay queryable. The OSINT research an agent does for each case is context assembled per run, not a store Sardine keeps.

SourceSardine, sardine.ai and sardine.ai/agentic-ai-for-amlread 2026-09-06

A maintained investigative corpus sits behind the agents. The Context Engine in Variance's catalog does entity resolution, fraud pattern detection and link discovery over the customer's mapped universe of entities, events and relationships, and the Linkage Deep Dive tool tracks related entities from common identifiers. Every finding grounds in verifiable external evidence carried into the audit logs. An ontology and data lake sit behind it.

SourceVariance, variance.com/product/toolsread 2026-09-07

Case management centralizes alerts, transactions, customer history, investigation findings and decisions, and agents draw on that history when summarizing a case. That is the application's data model and audit record, not a memory layer. There is no memory with a stated scope and lifetime, and no conversational session state.

SourceSardine, sardine.ai/agentic-ai-for-aml and sardine.airead 2026-09-06

Customers control what the platform keeps and for how long, though it has no memory layer of its own. Retention is customer-configured per workspace, and zero-data-retention configurations keep data from persisting beyond a single request. The context engine and data lake are the investigation corpus, not memory. There is no agent memory layer distinct from that corpus, and Variance does not say whether agents carry anything from one investigation into the next.

SourceVariance, variance.com/securityread 2026-09-07

Every alert triage arrives as a disposition recommendation with rationale for human review. Business verification packages findings so analysts approve low risk cases and review higher risk ones, and the SAR agent drafts only if the analyst decides to file. Agents work within defined workflows under structured human oversight, not in place of analyst judgment. The review and approve step sits in Sardine's own case management.

SourceSardine, sardine.ai/agentic-ai-for-amlread 2026-09-06

The customer's own playbook is the guardrail. The SOP enforcement layer encodes compliance procedure in plain language, and agents execute it consistently and traceably. The audit surface records every agent or human decision, human decision points sit in the loop across review tiers, and decisions return as cited packages under the customer's own procedures. There is no configurable threshold for what routes to review.

SourceVariance, variance.com/security and variance.com/product/toolsread 2026-09-07

Attestation and control documentation sit in a Vanta security portal at security.sardine.ai. No SSO, RBAC or certification statement appears on the main site or in the public documentation, and the full technical suite is behind a login, so the controls look gated, not absent. No SOC 2 report, SSO or role based access detail is available outside that portal.

Sourcesecurity.sardine.airead 2026-09-06

Variance is SOC 2 Type II certified. It offers enterprise SSO, fine-grained role-based access controls, workspace-configured retention, and immutable timestamped audit logs of every agent action, decision and configuration change. AI-specific guardrails cover prompt injection defenses, output validation and behavior boundaries, with 24/7 SIEM monitoring, named penetration testing by Calif, and a trust center at trust.variance.com. Customer managed keys are offered alongside the on premise and air gapped options. Variance is pursuing AIUC-1 certification but does not yet hold it.

SourceVariance, variance.com/securityread 2026-09-07

There are defensible audit trails at every step, audit ready documentation kept by the agents, a rationale attached to each disposition recommendation, and case summaries that link transactions, alerts, customer history, findings and supporting evidence in one view for governance and regulator review. The public pages show no exportable log of user actions.

SourceSardine, sardine.ai/agentic-ai-for-amlread 2026-09-06

Every agent action, decision and configuration change has an immutable, timestamped record ready for review, and audit logs cover every agent or human decision. Decisions and logs export directly to a SIEM, and every finding in the agent audit logs is grounded in verifiable external evidence.

SourceVariance, variance.com/security and variance.com/product/toolsread 2026-09-07

Sardine does not say where customer data is hosted. No hosting provider, region, customer environment option or sub processor list is published on the main site or in the public documentation. A security portal runs at security.sardine.ai.

Sourcesecurity.sardine.airead 2026-09-06

Three deployment models are offered. They are fully managed cloud, private VPC peering with the data staying in the customer's network, and on-premise or air-gapped with no external connectivity for the most sensitive environments, plus dedicated environments and zero-data-retention configurations. The choice extends to the customer's own infrastructure, air gapped and sovereign setups included.

SourceVariance, variance.com/securityread 2026-09-07

Ten prebuilt agents are offered for customers to adopt (OSINT Search, Data Analyst, Rule Assistant, Transaction Monitoring, Business Due Diligence, Doc KYC, PEP Screening, Graph Analyst, Sanctions Screening, SAR Generation), sold as Agentic Fraud Ops and Agentic AML Ops, over a catalog of modular product building blocks across onboarding, fraud prevention, cyber security and AML compliance. Each agent works on its own, so without the SAR Generation Agent the screening and research agents are still whole.

SourceSardine, sardine.ai and sardine.ai/agentic-ai-for-amlread 2026-09-06

The tool catalog is a literal marketplace of plug-and-play investigative tools that Variance enriches regularly. Four solution workflows, Know Your Customer, Know Your Business, Transaction Monitoring and Customer Due Diligence, each have their own page and are adopted selectively. They are whole investigation products, not stages of one pipeline.

SourceVariance, variance.com/product/tools and variance.com/solutionsread 2026-09-07

Sardine does not name the language model behind the agents, and there is no customer or admin model selection or routing across providers on Sardine's side. The platform's own fraud and credit models, which customers can build, test and deploy and, in a testimonial, train, are machine learning tooling, not a choice of the model the agents run on.

SourceSardine, sardine.airead 2026-09-06

The platform runs Variance's own contextual reasoning. No model provider is named for any layer, and customers and admins have no choice of model. Models are not trained across customers by default, which is a data boundary, not a way to select a model.

SourceVariance, variance.com/securityread 2026-09-07

Sardine is sold as an API and SDK platform with a developer portal at docs.sardine.ai and a public status page. The documentation covers an API Reference for detecting fraud and risk and integration guides for onboarding users, and the public tier covers getting started, sandbox access and the integration timeline. The full API reference and integration guides sit behind a dashboard login, which is the access path customers use.

SourceSardine, docs.sardine.ai and docs.sardine.ai/llms.txtread 2026-09-06

Extension runs through Variance's catalog and its engineers, not a public developer surface. The marketplace of plug-and-play tools, custom agent composition, and the Snowflake connector into the customer's own databases give a customer real ways to extend the platform. The application lives at dashboard.intrinsicapi.com, a trace of the company's API-first heritage. There is no public API reference, SDK or MCP surface, and the engineering team configures tools with the customer, so setup is assisted, not self serve.

SourceVariance, variance.com/product/toolsread 2026-09-07

A customer can create, test and roll out transaction monitoring rules on the platform without engineering support, and the Rule Assistant Agent tunes rule thresholds to improve alert quality, fire rates and monitoring coverage. That evaluates a change to the customer's detection logic against measured outcomes before and after release, on Sardine's own surface.

SourceSardine, sardine.ai/agentic-ai-for-amlread 2026-09-06

No backtesting, test set or comparable result is published for customers, and nothing shows a playbook change being tested against past cases before it goes live. Variance's claim of human-level precision validated across hundreds of cases is its own validation of its own agents at a customer, not something a customer can run. Output validation is a runtime guardrail, not a test harness.

SourceVariance, variance.com/securityread 2026-09-07

The OSINT Search Agent searches online sources, social media and public databases at run time for each alert or case, so the agent does its own web research instead of drawing on a prebuilt index. Sardine does not say what mechanism it uses. The device intelligence and behavior biometrics SDK runs inside the customer's own application, which is the product running in a browser, not an agent operating one, and bot detection detects agentic automation instead of performing it. There is no browser, desktop or computer control that the agent drives.

SourceSardine, sardine.ai/agentic-ai-for-aml and sardine.airead 2026-09-06

Two tools in the catalog work in interfaces. A Web Browsing Agent browses the web to research and gather evidence, and a Computer Use tool accesses data behind internal tools and other apps. Both act inside interfaces Variance does not control, where fragility matters to a customer. Both are catalog entries with no stated depth of control or modality coverage, and Variance does not say how the Computer Use tool copes when an internal application changes.

SourceVariance, variance.com/product/toolsread 2026-09-07