Live Oak Labs Bankability Report

BLKBX

Report type
Company Bankability Report
Status
Illustrative internal draft
Programme fit
Bank Infrastructure / Regulated AI / UK Beachhead
Use case
Bank-grade evidence layer for black-box AI, vendor, and operational-risk review
Generated
2026-07-13
Recommended decision
Advance to controlled pilot and UK beachhead review.

Composite bankability

0/100
Cohort-ready

Cohort-ready. Advance to controlled pilot and UK beachhead review.

Start Over
01

Executive Bankability Score

DimensionScoreStatusNotes
Bank Workflow Fit100/100GreenProduct is tied to a real bank-owned workflow with a named owner and credible pull.
Diligence Readiness73/100YellowDiligence posture is coming together; several artifacts are still missing or draft.
Integration Clarity93/100GreenIntegration surface is bank-friendly: sidecar, read-only, standard ingestion, low bank lift.
AI / Model-Risk Readiness83/100GreenAI use is classified by autonomy, human-supervised, and instrumented for override, drift, and kill.
UK Legibility95/100GreenUK path is legible: regulatory route, buyer archetype, partner archetype, and counsel review are named.
Pilot Readiness100/100GreenPilot is narrow, measurable, and bounded — it could be approved by a bank operating committee.
Composite91/100GreenCohort-ready
Overall decisionAdvance to controlled pilot and UK beachhead review.

Dimension detail

Bank Workflow Fit

0/100

Product is tied to a real bank-owned workflow with a named owner and credible pull.

Top signals

  • WF-001Named bank workflow owner
  • WF-002Primary workflow specified
  • WF-003Evidence of buyer pull

Diligence Readiness

0/100

Diligence posture is coming together; several artifacts are still missing or draft.

Top signals

  • DI-001SOC 2 / ISO evidence
  • DI-006Encryption posture
  • DI-002Penetration test status

Integration Clarity

0/100

Integration surface is bank-friendly: sidecar, read-only, standard ingestion, low bank lift.

Top signals

  • IN-001Integration posture
  • IN-002No production write access in first pilot
  • IN-003No live customer data in first pilot

AI / Model Risk

0/100

AI use is classified by autonomy, human-supervised, and instrumented for override, drift, and kill.

Top signals

  • AI-001Autonomy classified
  • AI-002Human in the loop
  • AI-003Override logging

UK Legibility

0/100

UK path is legible: regulatory route, buyer archetype, partner archetype, and counsel review are named.

Top signals

  • UK-001Regulatory path identified
  • UK-002Buyer archetype named
  • UK-003Sandbox fit assessed

Pilot Readiness

0/100

Pilot is narrow, measurable, and bounded — it could be approved by a bank operating committee.

Top signals

  • PI-001Pilot objective
  • PI-002Success metric
  • PI-003Kill criteria
02

Company and Product Summary

Core argumentBLKBX is described as: Bank-grade evidence layer for black-box AI, vendor, and operational-risk review.

Operational design

  • Target workflow: AI-assisted third-party vendor review evidence capture.
  • Named bank owner: Head of Third-Party Risk Management.
  • Stage: concept or pre seed.

Execution artifact

BLKBX Evidence Dossier

Governance test

Can a bank product owner, risk officer, compliance reviewer, and model-risk reviewer understand what this records, what it does not, who controls it, and how evidence is verified?

03

Strategic Fit With Live Oak Labs

Core argumentProgramme fit: Bank Infrastructure / Regulated AI / UK Beachhead.

Operational design

  • Enter the programme under bounded labels — not a general 'trust layer' claim.
  • Anchor to one bank workflow rather than a portfolio pitch.

Execution artifact

Live Oak Use-Case Memo

Governance test

Does the company enter with one bounded workflow rather than a broad platform claim?

04

Bank Workflow Fit

Core argumentBLKBX fits where banks need proof that an automated or semi-automated system behaved within approved boundaries.

Operational design

  • Primary workflow: AI-assisted third-party vendor review evidence capture.
  • Current workaround: Evidence scattered across PDFs, emails, portals, spreadsheets, GRC tools.
  • Evidence of pull: high.

Execution artifact

Bank Workflow Fit Map

Governance test

If the workflow owner and evidence buyer cannot be named, the offering becomes too abstract to underwrite.

05

Integration Surface

Core argumentThe product should be easiest to adopt when it acts as a sidecar, not a core production system.

Operational design

  • Posture: read only sidecar.
  • Production access in first pilot: no.
  • Live customer data in first pilot: no.

Execution artifact

Integration Surface Map

Governance test

The first pilot should remain read-only or evidence-only and require no production write access.

06

Data-Flow Map

Core argumentEvidence capture can easily become data overcollection. The data model must be narrow, intentional, and reviewable.

Data classPilot posture
Vendor documentsAllowed with permission
System logs (event IDs, timestamps)Allowed if non-sensitive
AI outputs (summaries, recommendations)Allowed with model-risk review
Human approvalsAllowed
Customer PIIAvoid in first pilot
Model prompts / retrieved contextRedact or hash where possible

Execution artifact

Data-Flow Map

Governance test

No data-flow map, no pilot.

07

Bank Diligence Pack Status

Core argumentA product that sells trust infrastructure must be stronger than the average early-stage SaaS on its own diligence posture.

Evidence itemStatus
SOC 2 / ISOroadmap
Pen testplanned
Incident responsedraft
DR / BCPdraft
Subprocessor registerneeds register
Encryptionplanned documented

Execution artifact

Bank Diligence Pack v0.1

Governance test

Is there enough evidence to survive a formal vendor-risk review?

08

RACI / Control Ownership

Core argumentThe product must clarify whether it records evidence, verifies evidence, interprets evidence, or makes decisions — those are different control roles.

Operational design

  • Bank remains accountable for regulated decisions.
  • Accountable owner (this side): Bank Head of Third-Party Risk.
  • Responsible owner (this side): BLKBX pilot lead.
  • Escalation path: Bank TPRM → CISO → Chief Risk Officer.

Execution artifact

Pilot RACI Matrix

Governance test

The company should not be positioned as the party that certifies a vendor, AI system, or regulated process unless the legal and assurance model supports that claim.

09

Operating Risk Posture

Core argumentA bank-embedded product must be a risk-managed environment: it cannot reduce opacity while creating new uncontrolled data, cyber, model, or operational exposure.

Operational design

  • Live customer data in first pilot: no.
  • Production access: no.
  • No customer-impacting action in first pilot.
  • No unreviewed AI-generated compliance determinations.

Execution artifact

Risk Register

Governance test

If security, subcontractor, model-monitoring, or incident posture is inadequate only at the end of the programme, the company has not been accelerated — it has been exposed.

10

UK Beachhead Readiness

Core argumentUK financial institutions place heavy emphasis on operational resilience, outsourcing controls, data governance, auditability, and accountable technology use.

Operational design

  • Likely path: non_regulated_b2b_saas.
  • Buyer archetype: UK bank third-party-risk teams.
  • Partner archetype: UK GRC / operational-resilience partner.

Execution artifact

UK Beachhead Pack v0.1

Governance test

Do not claim UK compliance. Claim: 'helps produce reviewable evidence for UK compliance, operational resilience, vendor diligence, and AI governance workflows.'

11

Regulatory Pathway

Core argumentThe product is best positioned as non-regulated B2B infrastructure if it does not make regulated decisions, advise consumers, approve credit, initiate payments, or act as a regulated intermediary.

Operational design

  • Preliminary pathway: non regulated b2b saas.
  • Pathway must be counsel-reviewed. Triage, not legal advice.

Execution artifact

Regulatory Pathway Memo

Governance test

Avoid: 'certifies compliance', 'approves vendors', 'automates regulatory approval', 'makes AI compliant', 'eliminates bank diligence'.

12

AI / Model-Risk Classification

Core argumentAI products must be governed by autonomy level, not generic 'AI safety' claims.

Operational design

  • Autonomy level: consultant.
  • Human in the loop: yes.
  • Override logging: yes.
  • Drift monitoring: planned.
  • Kill switch: planned.

Execution artifact

AI Governance File

Governance test

The first pilot should focus on evidence capture for AI-assisted review, not autonomous action.

13

Commercial ROI Model

Core argumentThe commercial value is not 'better logs' — it is diligence-cycle compression, audit-prep reduction, incident reconstruction, and risk-review confidence.

Operational design

  • ROI = (cost reduction + risk reduction) / (integration cost + oversight cost).
  • Model at least three quantified value drivers before Decision Day.

Execution artifact

Pilot ROI Worksheet

Governance test

If it only saves time for the startup, the bank may not care. The ROI case must show value to the bank reviewer.

14

Mentor Pod Assignment

Core argumentMentor density is the substitute for vague ecosystem access: pods must have defined roles, review cadences, and deliverable responsibilities.

Operational design

  • Product sponsor, integration architect, third-party-risk reviewer, cybersecurity reviewer, compliance lead.
  • Model-risk reviewer, operational-resilience reviewer, UK regulatory advisor, commercial buyer coach.
  • Every mentor session ends with: objection, required evidence, artifact change, owner, due date.

Execution artifact

Mentor Pod Review Notes

Governance test

The pod must produce artifact changes, not general feedback.

15

Market Validation Log

Core argumentObjections are not bad; they are the raw material for bankability.

Operational design

  • Log every reviewer objection with severity and required response.
  • Close objections only when the artifact changes or a qualified reviewer accepts the response.

Execution artifact

Market Validation Log

Governance test

An objection is closed only when the report artifact changes.

16

Pilot Design

Core argumentThe first pilot should be narrow, low-customer-risk, and evidence-obvious.

Operational design

  • Objective: Generate a complete, verifiable evidence bundle for AI-assisted vendor diligence.
  • Duration: 90 days.
  • Success metric: Reduce evidence collection and review cycle time while improving completeness.
  • Kill criteria: Evidence bundle incomplete, inaccurate, unverifiable, or too burdensome.

Execution artifact

Pilot Design Document

Governance test

The pilot must be rejected if it requires live customer data, production access, or automated regulatory decisioning before baseline diligence is complete.

17

Decision Day Recommendation

Core argumentRecommended decision: Advance to controlled pilot and UK beachhead review.

Operational design

  • Present buyer problem, validated workflow, integration design, data-flow map.
  • Present diligence status, risk controls, UK landing plan, pilot economics.
  • Make an explicit ask — pilot conversation, UK review, diligence remediation, advisory, or no-go.

Execution artifact

Decision Day Packet

Governance test

The ask should be a controlled evidence pilot, not full bank adoption.

18

Week 0–12 Programme Plan

Week 0Pre-Mortem and Cohort Charter
expand

Identify the failure mode before the sprint begins.

Core argumentWeek 0 prevents the programme from wasting bank, mentor, and founder time.

Operational design

  • Name the likely failure mode.
  • Name the weakest score dimension.
  • List missing evidence and data-risk exposure.
  • Name buyer, UK, and pilot-scope risks.
  • Weakest dimension: Diligence Readiness at 73/100.
  • Likely failure mode: overclaim on scope before evidence is ready.

Execution artifact

Pre-Mortem Charter

Governance test

No company should begin Week 1 without a bounded workflow, evidence-gap list, and risk posture.

Week 1Bank Workflow Orientation
expand

Translate the pitch into a bank-owned workflow.

Core argumentA fintech is not bankable until it maps to a bank-owned workflow.

Operational design

  • Chosen workflow: AI-assisted third-party vendor review evidence capture.
  • Name the workflow, bank owner, and control owner.
  • Document current pain, workaround, and measurable value.
  • Identify the operating risk category.

Execution artifact

Live Oak Use-Case Memo

Governance test

Can a bank buyer understand what this solves and who owns it?

Actions

  • Interview the target workflow owner (or their proxy) within 5 days.
  • Draft one-page use-case memo with named buyer and measurable friction.
Week 2Bank Pain and Buyer Validation
expand

Prove the problem is real, budgeted, and painful.

Core argumentThe problem must be real, budgeted, and painful enough to justify diligence.

Operational design

  • Confirm buyer owner and budget owner.
  • Quantify friction cost and urgency.
  • Map the procurement path and decision criteria.

Execution artifact

Bank Workflow Fit Map

Governance test

A vague 'bank innovation' buyer is not enough — is the owner named?

Actions

  • Log 3–5 buyer conversations in the Market Validation Log.
  • Convert one objection into a required-evidence line item.
Week 3Technical Integration and Data Flow
expand

Map every point where the product touches bank systems and data.

Core argumentBank readiness depends on knowing where you touch bank systems and data.

Operational design

  • Document APIs, webhooks, logs, and manual paths.
  • Draw data inputs, outputs, auth, and hosting.
  • State the exit / portability path.

Execution artifact

Integration Surface Map + Data-Flow Map

Governance test

No data-flow map, no pilot.

Actions

  • Produce an evidence-sidecar architecture diagram for the first pilot.
  • State explicitly what the first pilot will NOT touch.
Week 4Diligence Readiness Sprint
expand

Assemble the vendor-review evidence pack.

Core argumentThe post-demo bottleneck is vendor onboarding, not founder storytelling.

Operational design

  • Publish SOC 2 / ISO posture (or credible roadmap).
  • Publish pen-test, IR, DR/BCP, subprocessor, retention posture.
  • Publish encryption architecture, IAM model, and audit log design.

Execution artifact

Bank Diligence Pack v0.1

Governance test

Does the company have enough evidence for a serious vendor-risk review?

Actions

  • Draft evidence-verification specification.
  • Post subprocessor register with owners.
  • Weak diligence score — commission SOC 2 readiness assessment this month.
  • Publish subprocessor register with data-flow annotations.
Week 5UK Beachhead Week
expand

Translate US assumptions into UK regulatory and buyer terms.

Core argumentThe UK track is a regulatory and buyer-translation exercise, not a branding one.

Operational design

  • Map bank partner → authorised institution / principal / partner.
  • Map vendor diligence → operational resilience / outsourcing controls.
  • Map AI tooling → accountability, oversight, explainability.

Execution artifact

UK Translation Matrix + UK Beachhead Pack v0.1

Governance test

Can the company explain its UK path without overclaiming regulatory status?

Actions

  • Have UK counsel review the pathway memo before Week 8.
  • Name the first UK buyer archetype and partner archetype.
Week 6AI / Model-Risk and Control Ownership
expand

Classify AI on autonomy and instrument the controls.

Core argumentAI products need governance by autonomy level, not generic 'AI safety' claims.

Operational design

  • Classify each AI function on the Operator/Collaborator/Consultant/Approver/Observer spectrum.
  • Document human boundary, override, drift, escalation, and kill switch.
  • Name accountable owner per AI function.

Execution artifact

AI Governance File

Governance test

Does the company preserve bank accountability at every autonomy level?

Actions

  • Freeze prompt/output logging policy.
  • Draft kill-switch runbook.
  • Weak AI score — freeze autonomy classification and override logging policy this week.
  • Draft kill-switch runbook and drift-monitoring plan.
Week 7RACI and Operating Risk
expand

Clarify who owns every material risk.

Core argumentBank-fintech partnerships fail when control ownership is ambiguous.

Operational design

  • Draft pilot RACI across incidents, disputes, model changes, data access, releases, outages.
  • Publish risk register with severity and control.
  • Name termination process and exit plan owner.

Execution artifact

Pilot RACI Matrix + Risk Register

Governance test

Can the bank tell who owns every material risk?

Actions

  • Have risk register reviewed by a third-party-risk advisor.
  • Confirm every 'A' in RACI is a real, named person.
Week 8Pilot Design Sprint
expand

Design a controlled, approvable first pilot.

Core argumentThe first pilot must be narrow enough to approve and meaningful enough to matter.

Operational design

  • Define objective, scope, out-of-scope, users, data set.
  • Define success metric, kill criteria, duration, fallback.
  • State evidence output.

Execution artifact

Pilot Design Document

Governance test

Would a bank operating committee approve this controlled test?

Actions

  • Confirm no live customer data and no production write access in first pilot.
  • Confirm accountable owner on the bank side.
Week 9Commercial ROI and Evidence Room
expand

Assemble the buyer-ready decision packet.

Core argumentA bank will not adopt a tool because it is interesting — it needs a decision package.

Operational design

  • Model ROI: cost reduction, risk reduction, oversight cost, integration cost.
  • Publish evidence room index.
  • Produce buyer-ready presentation and UK Beachhead Pack update.

Execution artifact

Buyer-Ready Packet (diligence + pilot + UK + ROI + evidence register)

Governance test

Can the company enter Decision Day with reviewable evidence instead of claims?

Actions

  • Validate ROI baseline with two bank-side reviewers.
  • Freeze evidence room v1.0.
Week 10Decision Day
expand

Present a bank-readiness decision, not a pitch.

Core argumentDecision Day is a bank-readiness decision, not a pitch event.

Operational design

  • Present buyer problem, validated workflow, integration design, data-flow map.
  • Present diligence status, risk controls, UK landing plan, pilot economics.
  • Make an explicit ask.

Execution artifact

Decision Day Packet

Governance test

The decision should be one of: advance to pilot, advance to UK review, advance to diligence remediation, continue advisory, or no-go.

Actions

  • Circulate the Decision Day Packet to reviewers 5 business days before the session.
  • Log the decision and named next step against every open objection.
Week 11Post-Mortem I: Evidence Audit
expand

Ask whether the sprint produced bank-reviewable artifacts.

Core argumentWeek 11 asks whether the report and sprint produced bank-reviewable artifacts.

Operational design

  • Review missing evidence and unresolved objections.
  • Record score movement across the 6 dimensions.
  • Log mentor notes, buyer feedback, and counsel-review items.

Execution artifact

Post-Mortem Evidence Audit

Governance test

What changed because of the sprint?

Actions

  • For every open objection, name owner + due date.
  • Version-tag every artifact touched during the sprint.
Week 12Post-Mortem II: Pilot / Cohort Readiness
expand

Convert the sprint into a 30/60/90-day execution plan.

Core argumentWeek 12 converts the sprint into a 30/60/90-day execution plan.

Operational design

  • Finalise pilot recommendation and unresolved blockers.
  • Record legal, security, and UK review needs.
  • State commercial next step.

Execution artifact

Cohort Readiness Memo

Governance test

Is the company ready for pilot, remediation, advisory support, or no-go?

Actions

  • Produce the Cohort Readiness Memo with an explicit decision recommendation.
  • Hand the 30/60/90 plan to the founder team with owners assigned.
19

30 / 60 / 90-Day Follow-Up Plan

Day 30

Due 2026-08-12

Close foundational evidence gaps.

  • ProductFinalise use-case memo and evidence schema for the first workflow.
  • SecurityProduce architecture, IAM, encryption, subcontractor, and incident docs.
  • DataComplete data-flow and retention map.
  • AI governanceClassify AI functions using the autonomy spectrum.
  • LegalDraft non-regulated B2B positioning memo.
  • UKDraft UK Beachhead Pack v0.1.
  • CommercialIdentify first three buyer personas and pilot sponsors.
  • SecurityClose top 3 diligence gaps and refresh evidence index.
  • AI governanceComplete drift monitoring plan and override log spec.

Output: 30-Day Evidence Completion Check

Day 60

Due 2026-09-11

Move from artifact creation to reviewer feedback.

  • ProductBuild pilot evidence capture workflow.
  • RiskComplete pilot RACI.
  • CyberComplete security evidence index and close pen-test gaps.
  • ComplianceDefine review and export format.
  • UKReview data, regulatory, and resilience posture with UK advisor.
  • CommercialSecure pilot-design feedback from 3–5 bank reviewers.

Output: 60-Day Reviewer Feedback Memo

Day 90

Due 2026-10-11

Prepare a controlled pilot or a no-go decision.

  • PilotRun controlled evidence replay against success metrics.
  • MetricsMeasure cycle-time reduction and completeness against baseline.
  • AuditExport evidence bundle and test reviewer usability.
  • LegalFinalise pilot agreement template.
  • UKConfirm UK pilot or Digital Sandbox path if appropriate.
  • CapitalDecide whether the company is ready for a strategic seed / pre-seed conversation.

Output: 90-Day Pilot Readiness Packet

20

Evidence Register

Claim / artifactStatus
Product positioningProposed / illustrative
Bank workflow use caseProposed
Non-regulated B2B pathwayPreliminary; counsel review required
UK beachhead thesisProposed
AI governance use caseModel-risk review required
Diligence-pack requirementsAligned with Live Oak Labs framework
Pilot designProposed
ROI metricsProposed baseline; needs buyer validation
Security posturePartial
Data-flow mapTo be supplied
Evidence verification methodTo be supplied
UK regulatory postureCounsel review required
21

Final Bankability Verdict

BLKBX is bankable if positioned correctly. Composite 91/100 — Cohort-ready. Advance to controlled pilot and UK beachhead review.

Bankability Preflight is an unofficial diagnostic operated by Bankabil. It is not affiliated with, endorsed by, or approved by Live Oak Bank, Live Oak Labs, Lloyd's Lab, the FCA, the PRA, or any regulator. It is not legal, regulatory, investment, or banking advice.