New AI triage closes 90% of false positives

See risk across
every PSP.

Fraud and money laundering hide in the gaps between payment providers. Crosswatch joins Adyen, Stripe, Mollie and the rest into one risk picture, and its AI triages what no single PSP can see.

  • EU-hosted
  • Built for the EU AML Regulation
  • Live in 30 days
Live4 PSPs connected18,402 transactions today2 open alertsDemo data
AdyenPayPalMollieStripe
TimePSPCustomerMethodAmountRisk
Alerts only Crosswatch can see

Watching…

Connects to
The problem

Every PSP sees a slice. Criminals know it.

Each PSP: nothing to flag. Eleven card attempts spread over three PSPs means three or four each, below every threshold.

What each PSP sees Last 38 min
  • Adyen3 card attemptsBelow threshold
  • PayPal4 card attemptsBelow threshold
  • Stripe4 card attemptsBelow threshold
  • Crosswatch11 cards · 1 deviceRisk 92

Crosswatch: one pattern. Every rail streams into one customer graph, so the pattern shows up in under a minute.

  • One customer profile across every PSP, card, IBAN and device.
  • Scores in under 200 ms, fed back into checkout before you capture.
  • Explainable alerts: which signals fired, on which PSPs, with the transactions.
Crosswatch AI

AI does the triage. Your analysts do the judging.

Overnight, Crosswatch AI closes the obvious false positives with a written reason, links accounts across PSPs, spots patterns none of your rules cover and tunes the rules you have. In the morning your team gets a short list, ranked by risk.

Alerts raised overnight412
Closed by AI, with reasons371
Grouped into cases32
Need an analyst9
Crosswatch AIOvernight run · 06:00

Refunds to a different rail are up 240% on Mollie

Purchases paid by card on Adyen are being refunded to new iDEAL accounts through Mollie. 31 customers, most created in the last 10 days. None of your current rules covers it.

€38,400at risk this week
Cross-rail refunds per day
Customers involved
31
Average account age
8 days
Paid on
Adyen, card
Refunded to
Mollie, new IBANs
High confidence · unseen in the last 12 months
  • Shows its work. Every closed alert and insight has a written reason and the evidence behind it.
  • Your data stays yours. Processed in the EU and never used to train models for anyone else.
  • Human in the loop. AI triages and recommends. Only your team can block, report or approve.
Built for

One platform, three ways in.

Stop fraud that hops between your checkouts

You route payments over several PSPs for cost and uptime. Fraudsters spread their attempts the same way, so each PSP sees too little to act.

  • One customer profile across every PSP
  • Real-time scores you can feed back into checkout
  • Fewer chargebacks, fewer good customers blocked
Example
A device tries 11 stolen cards in 38 minutes, spread over three PSPs so none of them hits its own limit.
92 Flagged in under a minute, device blocked on all three.
Detection library

The patterns teams report, looked at across every rail.

Twelve detections out of the box, each tuned to work across PSPs. Add your own rules and back-test them on a year of history before they go live.

FraudLive

Card testing

Many cards tried from one device or IP in a short window, usually small amounts.

Why it needs every PSP

Attempts are spread so each PSP stays under its own limit.

Alerts, 30 days86
Confirmed81%
Signals
device fingerprintIPcard BINdecline codes
Developers

Plug in what you have. Score in real time.

Connect each PSP the way it already exports data, send events from your checkout, and get a score back before you capture the payment.

PSP APIs and webhooks
Transactions, refunds, chargebacks and payouts as they happen.
Settlement files
Daily SFTP or bucket drops, for PSPs without a usable API.
Your own events
Sign-ups, logins, device data and order details from your app.
Back to you
Alerts by webhook, cases in Slack or Teams, reports as goAML.
POST /v1/score200 · 84 ms
{
  "event": "payment.authorise",
  "psp": "adyen",
  "amount": { "value": 4999, "currency": "EUR" },
  "customer": { "id": "c_48120", "email_hash": "9f2c…" },
  "device": { "id": "d_7f21", "ip": "85.x.x.14" },
  "card": { "bin": "535522", "last4": "4417" }
}
Response
{
  "score": 92,
  "decision": "review",
  "reasons": [
    "device_seen_on_3_psps",
    "11_cards_in_38_min",
    "declines_above_baseline"
  ],
  "case_id": "CW-2041"
}
Onboarding

From kickoff to live monitoring in 30 days.

Day 1Kickoff

Your PSPs, flows and current controls mapped with your compliance lead.

Week 1Connect

PSPs connected, 12 months loaded, customers resolved across rails.

Week 2Tune

Detections back-tested on your history. See what would have fired.

Week 3Shadow

Live scoring next to your current process, without decisions.

Day 30Live

Alerts, cases and reporting on, with your team trained.

Compliance

Built for the EU AML rulebook. Ready for your auditor.

The EU AML Regulation applies from July 2027 and raises the bar on monitoring, record-keeping and reporting. Crosswatch keeps the evidence for every decision: what you saw, when, and what you did.

Hosting
EU only: Frankfurt and Amsterdam, with no transfers outside the EEA.
Encryption
AES-256 at rest, TLS 1.3 in transit, keys managed per customer.
Retention
Five years by default, in line with EU AML record-keeping. Configurable per data type.
Access
SSO with SAML, role-based permissions and four-eyes approval on reports.
Audit
Every view, decision and export is logged, immutable and exportable.
Privacy
GDPR data processing agreement as standard; personal data minimised and hashed where possible.
Changelog

Shipped lately.

New detections, connectors and list sources every week. Rules you already run never change without your approval.

  1. DetectionRefund-to-other-rail

    Flags refunds paid out to a different PSP or account than the original payment.

  2. ScreeningFaster list updates

    EU and UN sanctions lists are now checked every 15 minutes, and every customer is re-screened when a list changes.

  3. ReportinggoAML export

    Suspicious transaction reports export in the goAML format used by the Dutch FIU and many others.

  4. ConnectorCheckout.com webhooks

    Payments, disputes and payouts from Checkout.com now stream in real time.

Our promise

Built to pass your auditor's questions.

  • EU only

    Processed and stored in Frankfurt and Amsterdam, never outside the EEA.

  • Explainable

    Every alert and AI decision shows its reasons and evidence.

  • Human in the loop

    Only your team can block, report or approve.

  • Deletion on exit

    Leave any time; your data is deleted within 30 days, with a certificate.

Why we built it

Every payments team I spoke to had the same blind spot: each PSP sees its own slice, and the patterns that matter only show up across all of them.

Crosswatch is the view that should have existed from the start.

Nick van der WildtFounder, Made for Interaction
FAQ

Questions from compliance teams.

Which PSPs does Crosswatch connect to?

Any PSP with an API or settlement files, including acquirers, wallets, bank-transfer providers and BNPL. Most connections are live within a day.

Do we still need our PSPs' own fraud tools?

Keep them. Crosswatch sits on top and adds what no single PSP can: the view across all of them, in one profile per customer.

Does Crosswatch decide or block on its own?

It scores and alerts in real time, and can feed decisions back to your checkout. Final calls on cases and reports stay with your team.

How does reporting to the FIU work?

Crosswatch drafts the report from the case file, with the transactions and evidence attached. Your compliance officer reviews and files it.

Who is it for?

Merchants and marketplaces using several PSPs, platforms that pay out to sellers, and PSPs that want to see across their sub-merchants.

Get started

The gaps between PSPs
are where risk hides.