Unit21 vs Variance (2026)

More than thirty named systems connect across eleven categories. They include core banking (Fiserv DNA, Finxact and Premier, Jack Henry SilverLake and Symitar, Corelation), digital banking (Alkami, Q2, Finastra, NCR), banking as a service (Unit, Treasury Prime), data warehouses (Snowflake, BigQuery, Databricks, Aurora), KYC and KYB providers, watchlists, crypto analytics, device intelligence and check images. Salesforce and Zendesk sync case records and investigation outcomes in both directions, and a proprietary ingestion layer is described as integrating with any tool.

SourceUnit21, unit21.ai/integrationsread 2026-09-06

The tool catalog has named entries across seven categories. They include sanctions screening across 1,400-plus programs, PEP screening, adverse media in 30-plus languages, litigation and dockets, UBO enrichment, device and IP intelligence, corporate registries individually listed across 50-plus jurisdictions with the countries named, and a suite of verification tools. A named Snowflake connector retrieves from the customer's own databases, and a full integration list is available on request.

SourceVariance, variance.com/product/toolsread 2026-09-07

Agents run the financial crime lifecycle end to end, from alert triage and evidence gathering through case investigation and entity network expansion, narrative drafting and filing preparation, QA checks against SOP steps and detection improvement. They investigate step by step and take or recommend the workflow action. A task builder lets a team define new agent tasks and workflows configured to its own escalation rules.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

Customers compose their own investigative agents and encode their own workflows. The platform offers first-party tools for custom investigative agents, and customers compose agents from the catalog. The SOP layer encodes any investigative workflow in plain language for consistent, traceable execution. A full investigation runs end to end through evidence pull, ownership tracing, screening, and a structured Decision plus Evidence Pack, and a second agent monitors continuously.

SourceVariance, variance.com/product/toolsread 2026-09-07

The agents pick up alerts raised by the platform's real time detection and transaction monitoring, which they ingest for triage, and data arriving through the ingestion integrations from core banking, payment and warehouse systems. Unit21 describes an alert entering, being investigated and reaching a filing in one environment. There is no schedule or webhook the customer configures.

SourceUnit21, unit21.ai/products/ai-agent and unit21.ai/integrationsread 2026-09-06

Two kinds of trigger exist. Investigations start from alerts in transaction monitoring, and the continuously monitoring second agent surfaces relationships outside predefined rules, with SIEM export as the outbound path. There is no trigger surface customers configure, no schedule, no event subscription and no channel beyond the application, and Variance does not say which events can start an investigation or where results can go besides the SIEM.

SourceVariance, variance.com/solutions/transaction-monitoring and variance.com/securityread 2026-09-07

Agents investigate over the platform's own data model. They expand entity networks during case investigation, query the alert's own data through the Data Analysis task, and draw on transaction, customer and case history ingested into the platform from core banking, warehouse and KYC systems, a store that persists across alerts and can be queried.

SourceUnit21, unit21.ai/products/ai-agent and unit21.ai/integrationsread 2026-09-06

A maintained investigative corpus sits behind the agents. The Context Engine in Variance's catalog does entity resolution, fraud pattern detection and link discovery over the customer's mapped universe of entities, events and relationships, and the Linkage Deep Dive tool tracks related entities from common identifiers. Every finding grounds in verifiable external evidence carried into the audit logs. An ontology and data lake sit behind it.

SourceVariance, variance.com/product/toolsread 2026-09-07

Unit21 says dispositions and feedback improve future detection and decisioning over time, which is learning absorbed into its models, not a memory, and the entity networks and case records the agents work over are the platform's data model. There is no agent memory and no conversational session state.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

Customers control what the platform keeps and for how long, though it has no memory layer of its own. Retention is customer-configured per workspace, and zero-data-retention configurations keep data from persisting beyond a single request. The context engine and data lake are the investigation corpus, not memory. There is no agent memory layer distinct from that corpus, and Variance does not say whether agents carry anything from one investigation into the next.

SourceVariance, variance.com/securityread 2026-09-07

The agents keep a human in the loop by default. Each agent run recommends a close or escalation, or takes the workflow action directly within the guardrails the customer configures. The customer sets when a human must review or approve and configures approval gates, narratives are drafted ready for QA and approval, and every task builder run is approved by a human.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

The customer's own playbook is the guardrail. The SOP enforcement layer encodes compliance procedure in plain language, and agents execute it consistently and traceably. The audit surface records every agent or human decision, human decision points sit in the loop across review tiers, and decisions return as cited packages under the customer's own procedures. There is no configurable threshold for what routes to review.

SourceVariance, variance.com/security and variance.com/product/toolsread 2026-09-07

Unit21 holds SOC 2 Type I and Type II, attested by Armanino, with penetration tests by Doyensec and Cobalt, and states GDPR and CCPA compliance. The access controls it describes are its own, with Auth0 for authentication, MFA required for staff to reach production and logging of staff access to customer data. It does not say how a customer's own users are identified, provisioned or given roles.

SourceUnit21, unit21.ai/security and unit21.ai/products/ai-agentread 2026-09-06

Variance is SOC 2 Type II certified. It offers enterprise SSO, fine-grained role-based access controls, workspace-configured retention, and immutable timestamped audit logs of every agent action, decision and configuration change. AI-specific guardrails cover prompt injection defenses, output validation and behavior boundaries, with 24/7 SIEM monitoring, named penetration testing by Calif, and a trust center at trust.variance.com. Customer managed keys are offered alongside the on premise and air gapped options. Variance is pursuing AIUC-1 certification but does not yet hold it.

SourceVariance, variance.com/securityread 2026-09-07

Every agent run produces a transparent work log, a trace of every step taken, data accessed, checks performed and assumptions made. The rationale for each recommendation is tied to evidence and policy logic, with a full audit trail of the who, what and why, and the platform traces runs after deployment.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

Every agent action, decision and configuration change has an immutable, timestamped record ready for review, and audit logs cover every agent or human decision. Decisions and logs export directly to a SIEM, and every finding in the agent audit logs is grounded in verifiable external evidence.

SourceVariance, variance.com/security and variance.com/product/toolsread 2026-09-07

Unit21 encrypts backups and segments its network but names no hosting provider, region or customer environment option, and its documentation is password protected. It does not say where customer data is hosted or whether a region can be chosen.

Sourceunit21.ai/securityread 2026-09-06

Three deployment models are offered. They are fully managed cloud, private VPC peering with the data staying in the customer's network, and on-premise or air-gapped with no external connectivity for the most sensitive environments, plus dedicated environments and zero-data-retention configurations. The choice extends to the customer's own infrastructure, air gapped and sovereign setups included.

SourceVariance, variance.com/securityread 2026-09-07

The products are modules of one platform (transaction monitoring, case management, payment and sanction screening, customer risk rating, regulatory filings), and the Agentic Task Builder lets a team build its own agent tasks in plain English. The agents are configured to each program's SOPs and thresholds, not chosen from a catalog, and Unit21 mentions templates for agent tasks without publishing a catalog.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

The tool catalog is a literal marketplace of plug-and-play investigative tools that Variance enriches regularly. Four solution workflows, Know Your Customer, Know Your Business, Transaction Monitoring and Customer Due Diligence, each have their own page and are adopted selectively. They are whole investigation products, not stages of one pipeline.

SourceVariance, variance.com/product/tools and variance.com/solutionsread 2026-09-07

Customer data is never used to train Unit21's agents. Unit21 refers to its models without naming a provider, and there is no model selection for customers or admins and no routing across providers.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

The platform runs Variance's own contextual reasoning. No model provider is named for any layer, and customers and admins have no choice of model. Models are not trained across customers by default, which is a data boundary, not a way to select a model.

SourceVariance, variance.com/securityread 2026-09-07

There is a developer documentation portal at docs.unit21.ai, but it is password protected with no public tier. No API, SDK or MCP server is named for an outside caller to drive the platform. Unit21's proprietary data ingestion and its two way syncing with Salesforce and Zendesk move data in and out but do not let a caller drive the agents.

SourceUnit21, unit21.ai/integrations and unit21.ai/products/ai-agentread 2026-09-06

Extension runs through Variance's catalog and its engineers, not a public developer surface. The marketplace of plug-and-play tools, custom agent composition, and the Snowflake connector into the customer's own databases give a customer real ways to extend the platform. The application lives at dashboard.intrinsicapi.com, a trace of the company's API-first heritage. There is no public API reference, SDK or MCP surface, and the engineering team configures tools with the customer, so setup is assisted, not self serve.

SourceVariance, variance.com/product/toolsread 2026-09-07

Unit21 answers model risk with evaluation before deployment and tracing after it. In the task builder a team tests a new agent task against a real alert and sees the actual output before saving it, detection improvements are recommended from outcomes with validation, and implementation validates a workflow in parallel before expanding it.

Every agent is backtested against historical alerts already reviewed by experts before it touches a live queue, accuracy is measured against a golden set of alerts the customer's best analysts have already dispositioned, and once live a team can sample agreement and disagreement cases at random.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

No backtesting, test set or comparable result is published for customers, and nothing shows a playbook change being tested against past cases before it goes live. Variance's claim of human-level precision validated across hundreds of cases is its own validation of its own agents at a customer, not something a customer can run. Output validation is a runtime guardrail, not a test harness.

SourceVariance, variance.com/securityread 2026-09-07

The Agentic Task Builder's Online Search task runs the external research a team describes, for example checking an entity and connected businesses for adverse media or sanctions exposure, at run time against live alerts, and returns a verdict with sources. Unit21 does not say how the search runs, and there is no browser, desktop or computer control.

SourceUnit21, unit21.ai/products/ai-agentread 2026-09-06

Two tools in the catalog work in interfaces. A Web Browsing Agent browses the web to research and gather evidence, and a Computer Use tool accesses data behind internal tools and other apps. Both act inside interfaces Variance does not control, where fragility matters to a customer. Both are catalog entries with no stated depth of control or modality coverage, and Variance does not say how the Computer Use tool copes when an internal application changes.

SourceVariance, variance.com/product/toolsread 2026-09-07