Govern AI without slowing the bank.
Reign and Forge give Tier-1 banks a sovereign control plane for every model, agent, and workflow — with the evidence regulators want, generated automatically.
Your model risk team can't keep up — and your engineers shouldn't have to wait.
Banks are pressured to move fast on AI while OSFI, the OCC, and the EU AI Act tighten the screws. Most governance tools were built for spreadsheets, not LLMs and agents. Most DevOps platforms weren't built for federally regulated workloads. You need both — running together, evidence-first.
OSFI E-23 expects model-risk evidence across every AI use case, not just credit and capital models.
SR 11-7 model inventory and validation cycles still rely on Word docs and email chains.
Shadow AI: line-of-business teams are using public LLMs without procurement, security, or audit oversight.
Cloud-native AI platforms expose data residency and third-party risk concerns federally regulated banks can't accept.
The EU AI Act's high-risk classification pulls credit, fraud, and HR models into a new evidence regime.
Internal audit, second-line risk, and the regulator all want the same evidence — packaged differently.
How iTmethods serves banking
The Fortress Family — Reign, Forge, and BioCompute — gives regulated enterprises the trust, runtime, and sovereign infrastructure they need to move at AI speed.
Model Risk for the AI Era
Reign extends SR 11-7 / OSFI E-23 model risk across LLMs, agents, and embedded AI features — not just analytic models.
Sovereign by Default
Run on your VPC, your tenant, your data centre, or fully air-gapped. Customer data, prompts, and model weights never leave your environment.
Evidence Engine
Every prompt, response, tool call, and model decision is logged with a tamper-evident audit trail. Auditors get packs in minutes, not weeks.
Shadow AI Discovery
AI Gateway brokers every LLM call across the enterprise. Procurement and security finally see what's actually running in production.
Open RegTech
Built on FINOS AIGF and the OS-Climate / Common Domain Model approach — open, vendor-neutral controls Tier-1 banks can extend.
Three-Lines Friendly
Designed with first-line developers, second-line risk, and third-line audit in the same workflow. One source of truth, three views.
Products purpose-built for your stack
Pick what you need. Run it where you need it. Govern everything from one control plane.
Reign
AI Governance
The trust layer between your bank and AI. Gateway, MCP governance, and Evidence Engine in one control plane.
- Policy enforcement on every prompt and tool call
- Continuous evidence for OSFI E-23, SR 11-7, EU AI Act
- PII redaction, prompt-injection defense, content filtering
Forge
Managed Runtime
55+ managed DevOps and AI tools running in your environment. Sovereign by default, governed by Reign.
- Managed Jenkins, GitLab, JFrog, SonarQube, and more
- Air-gapped and private-cloud deployments supported
- Built-in compliance scanning and approval workflows
BioCompute
For Health & Pharma Lines
If your bank lends to or insures life sciences, BioCompute gives that book the same sovereign governance.
- Sovereign AI for HIPAA / GxP regulated data
- Joint risk management with your healthcare clients
- Air-gapped foundation model deployment
Built for the regulations you actually face
Evidence is generated automatically. Auditors, regulators, and internal risk teams get what they need — without your engineers writing another spreadsheet.
Enterprise model risk for federally regulated financial institutions in Canada — including AI/ML.
US Federal Reserve guidance on model risk management. Reign extends coverage to LLMs and agents.
Reign maps high-risk AI systems and produces conformity-assessment-ready evidence.
Forge is SOC 2 Type II certified. Evidence integrates directly with your existing trust program.
Aligned with FFIEC IT examination handbooks for AI, third-party risk, and operational resilience.
Data residency, right-to-explanation, and PII-redaction controls baked into the AI Gateway.
Where teams in banking are starting
Customer-facing copilots
Wealth advisor copilots, retail banking chatbots, and contact-centre assistants — governed end-to-end with full audit trails.
Credit and underwriting AI
Bring LLM-assisted credit memos and underwriting summaries under the same model-risk regime as your scorecards.
AML & fraud agents
Run agentic AI inside your security perimeter with controlled tool access, MCP governance, and immutable evidence.
Developer productivity
Forge runs the secure CI/CD platform; Reign governs Cursor, Copilot, and internal MCP servers used by engineers.
Regulator-ready reporting
Generate conformity-assessment-ready packs for OSFI, the OCC, the FCA, and EU NCAs in days, not quarters.
Third-party AI risk
Inventory and govern every AI vendor, model, and embedded feature — with the evidence your TPRM team needs.
Become a design partner. Help define enterprise AI governance for banking.
We are building Reign with a small cohort of Tier-1 banks and FINOS AIGF contributors. Cohort members shape the roadmap, get early access, and walk away with controls and evidence packs that match how their bank actually operates — not a vendor's idea of it.
Outcomes we are targeting with the cohort
These are the outcomes the design partner cohort is working toward together. Not historical claims — co-developed targets, transparently tracked.
Engineers & developers
AI tools without the IT and security blockers — and a runtime that actually meets bank standards.
- Sanctioned access to Cursor, Copilot, and internal MCP servers via Reign Gateway
- Forge Managed Runtime for the regulated CI/CD platform underneath
- No more shadow AI workarounds — and no more 9-month security reviews
Risk & audit
Continuous, tamper-evident evidence — packaged the way OSFI, the OCC, and your internal audit team actually want it.
- OSFI E-23, SR 11-7, and EU AI Act control mappings out of the box
- Evidence packs in minutes, not weeks of engineer time
- Three-lines-friendly: same data, three views, no duplicate effort
CIO, CRO, and the board
A defensible AI governance posture you can take to the regulator, the audit committee, and the analysts — without slowing AI delivery.
- Sovereign deployment — no vendor lock-in, no third-country exposure
- Open RegTech foundation aligned with FINOS AIGF, not a black-box stack
- Co-developed roadmap means your priorities ship, not someone else's
“Engineers should get their AI tools. Risk and audit should get the evidence. The board should get the governance posture they need — without any of them slowing the others down. That is what the cohort is being built to deliver.”
— iTmethods Design Partner Cohort thesis