Coverage window: October 30 to November 6, 2026. Every item links to its source.
This week:
- Clark launches Clerks, autonomous AI audit staff, and raises an $11M seed
- Fourthline and Veridas close their identity merger with up to €65M behind it
- HKMA's Project SAGE puts "Know Your Agent" on a regulator's roadmap
- 4 tools, identity M&A with up to €65M, a quieter funding week, deadlines to watch, and AI jobs
From the Scout
We Analyzed 111 Startup Trust Centers: We reviewed the public trust pages of 111 venture-backed software companies. 90% show SOC 2, 61% disclose a pen test, 44% now have an AI governance section, and only 12% show when the page was last updated. If a buyer is about to open your trust URL, this is the checklist for what they expect to see. (Read it)
Tool of the Week: Oneleet: Security-first compliance for teams chasing SOC 2, ISO 27001, HIPAA, and GDPR, with continuous monitoring, attack-surface scanning, and a bundled pentest plus vCISO. Pricing is custom (as of our Oct 19 review). It's relevant this week because Oneleet just shipped Supabase Exposure Scanning inside Attack Surface Management (see Tools below). (See the review · Compare alternatives)
Our Picks
1. Clark turns audit juniors into Clerks, and raises $11M to do it
Clark (formerly uiAgent) launched Clerks on November 2: autonomous AI employees assigned to audit engagements the way a staff auditor would be. Each Clerk reviews documents, runs tests, prepares workpapers, and follows up with clients when something is missing, then picks the work back up when the reply arrives. Licensed CPAs keep the judgments and the signature. More than 35 CPA firms already use Clark, including CliftonLarsonAllen, Aprio, Kreischer Miller, and Sensiba. The company also announced an $11M seed led by Touring Capital, with Marathon Management Partners, Rerail, and Sofeon Ventures returning, for $16M total. Clark offers firms a 100% accuracy guarantee and a peer review guarantee on the AI's work. (company post)
What it means for you: if you are a founder selling into mid-market or enterprise, your auditor's staff may already be partly AI. Expect tighter evidence requests and faster follow-ups, which rewards a clean, current trust page and a self-serve report download. If you run or advise a CPA firm, "AI that chases the PBC list for you" is no longer a demo. It is funded product with a named accuracy promise.
The signal: after last week's money poured into bookkeeping and tax agents, this week the same pattern hit assurance. The boring work of verifying claims is where autonomous employees are landing next.
2. Fourthline and Veridas close: Europe gets a larger identity and fraud stack
On November 3, Fourthline and Spain's Veridas completed their merger, first announced in July. Fourthline CEO Paul Stoddart runs the combined company from Amsterdam; Veridas co-founder Eduardo Azanza becomes president. The deal comes with up to €65M from Finch Capital, Seaya Andromeda, and Ashgrove Capital (debt). The group expects more than €50M revenue in 2026, aims for €85M ARR by 2029, and cites about €20M a year in run-rate synergies. Clients include Revolut, N26, Trade Republic, Qonto, and Bitpanda on the Fourthline side, and 350-plus Veridas clients across 25 countries. The companies frame the timing around AI-generated fraud (deepfakes, synthetic IDs) plus wider rules: EU AMLR, MiCA, eIDAS 2.0, and age-verification laws.
What it means for you: if you are a fintech or marketplace building KYC in Europe or LatAm, expect fewer but bigger identity vendors, and more pressure to prove you can stop AI-made fake IDs. If you sell into those buyers, "how do you detect deepfakes?" is joining the standard security questionnaire. Shortlisting now? See our guide to the best KYC and AML tools.
The signal: identity verification is consolidating just as banks and regulators start treating AI agents as a first-class identity problem (see pick 3).
3. A regulator puts Know Your Agent on the roadmap
On November 2, the Hong Kong Monetary Authority launched Project SAGE ("Securing Agentic Finance with Governance and Enablement") and an Agentic Finance Expert Group. One of four workstreams is Agent Identity: verifying AI agents' identities and delegated authority, including Know Your Agent (KYA) practices and authentication. The others cover use cases (B2C, B2B, machine-to-machine), interoperability, and legal questions such as liability and consumer protection. This is an exploration programme, not a new binding rule, but it is a central bank putting KYA in writing.
What it means for you: last week Socure, Shufti, and Persona all shipped agent identity products. This week a major Asian financial regulator named the same problem. If your product lets agents pay, buy, or open accounts, start documenting who the agent is, who authorized it, and what it is allowed to do. Bank partners will ask. Our Know Your Agent explainer covers the vendors and a buyer checklist.
The signal: "Know Your Agent" moved from vendor launch week to supervisory vocabulary in seven days.
Tools & Partnerships
Tools
- Clark: Clerks are autonomous AI audit employees that own engagement areas end to end (documents, tests, workpapers, client follow-ups) while CPAs retain sign-off. (link · our review)
- Oneleet: Supabase Exposure Scanning is now built into Attack Surface Management. It discovers Supabase projects from your apps and tests what an anon or signed-up user can actually read or write, with reproducible curl evidence. (link · our review)
- AvalonX: Continuous AI pen testing for SMBs on a monthly subscription. Enter a domain, get same-day findings in plain language, mapped to SOC 2, ISO 27001, PCI DSS v4.0, and HIPAA. Free initial test available. (link)
- Nace AI: Drex for Finance is a decision model for fraud, credit, filings, and AML-style triage. You supply the allowed answers; it picks one with a confidence score and cannot invent labels. Model id
drex-max-finance. (link · our review)
Partnerships
- Nothing major closed in this window.
Deal Desk
Funding
- Clark, autonomous AI employees for CPA audit work, raised an $11M seed led by Touring Capital (total funding $16M). (link)
- AvalonX, AI pen testing for SMBs, emerged from stealth with up to $10M from Ridown Capital (Oct 30). (link)
- Fourthline + Veridas closed with up to €65M of equity and debt from Finch Capital, Seaya Andromeda, and Ashgrove Capital tied to the merger. (link)
Mergers & Acquisitions
- Fourthline + Veridas: European digital identity, KYC, biometrics, and fraud prevention platforms combine under Fourthline's CEO, with HQ in Amsterdam. (link)
Grants
- Nothing major this week.
Deadlines & Rule Changes
- EU AI Act, Article 50(2) marking (Dec 2, 2026): Providers of generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to meet machine-readable marking and detection obligations. That is less than four weeks from this issue. If you ship image, audio, video, or text generation to EU users, confirm outputs are marked and detectable. (link)
- EU AI Act, new prohibitions (Dec 2, 2026): From the same date, prohibitions relating to generation or manipulation of non-consensual intimate material and child sexual abuse material apply. Product and trust-and-safety teams should treat this as a hard date, not a draft. (link)
- EU AI Act, Annex III high-risk (Dec 2, 2027): Standalone high-risk AI systems in Annex III must comply from December 2, 2027 (embedded high-risk in regulated products: August 2, 2028). Startups should map whether they are actually Annex III before budgeting a full high-risk programme. (link)
- HKMA Project SAGE (launched Nov 2, 2026): Not a compliance deadline yet, but Hong Kong's central bank is formally exploring Know Your Agent, agent authentication, and liability for agentic finance. Fintechs with HK exposure should track the Expert Group outputs. (link)
Other Relevant News
- Clark's own write-up of the seed: The company post walks through Clerks, Material Intelligence, and the accuracy and peer-review guarantees behind the $11M raise. (link)
- Trust-page cheat sheet still applies: Our October study of 111 startup trust centers remains the practical checklist this week: date the page, publish a pentest summary, and add an AI data-use section. (link)
- EU AI Act startup playbook: A lean guide for figuring out whether you are high-risk at all before you overbuild. Pair it with the official enforcement FAQ above. (link)
What People Are Saying:
- "Announcing Drex for Finance - the multimodal decision model, post-trained for sub-second financial decisions. Financial operations require precise, regulatory-grade decisions with zero hallucinations across filings, support, credit risk, live fraud prevention, quant signals, and..." - @NaceAI (link)
- "Met Sayak at NYC Tech Week when @mirrorphysics Physics was just starting SOC 2. A few months later: SOC 2 Type II. ~2.5 months after that: ISO 27001 + 42001. When AI is the product, trust can't wait. He's sharing how on Nov 17 →" - @francescabuild (link)
- "AvalonX is out of stealth with $10M from Ridown Capital. The Alpharetta, Georgia startup sells continuous penetration testing to small and midsize businesses on a monthly subscription. Its Artemis platform sends autonomous agents to attack a company's defenses, and human testers..." - @fundable_ai (link · AvalonX profile)
- "Hong Kong's central bank just launched Project SAGE, basically KYC for AI agents. Banks will need to know who the agent is and what the customer actually authorized it to do. That second part is where the disputes are going to land." - @benxiang (link)
- "Audits used to take armies of juniors. Clark just launched Clerks - AI employees that do audit work for CPA firms. $11M seed, 35+ firms already using it, 100% accuracy guarantee." - @Aisiexplorer (link)
AI Job Opportunities
- Senior Product Manager, GRC Platform at Vanta, owning platform primitives (search, imports, exports, approvals) and AI-first redesigns for mid-market and enterprise GRC
$207K to $244K, plus equity | Remote, U.S. (link · our review) - Security GRC Engineer at Eudia, building engineered controls and automated evidence across SOC 2, ISO 27001, HIPAA, and AI governance at a legal-AI startup
Salary not listed | Palo Alto, California (link) - Internal Security Compliance Auditor (LATAM) at Oneleet, pre-audit QA of client evidence across SOC 2, ISO 27001, PCI, HIPAA, and GDPR
$35K to $65K, plus equity (geo-banded) | LATAM, Remote (link · our review)
By the Numbers
Identity M&A dwarfed a quieter funding week
| Company | Amount | What they do |
|---|---|---|
| Fourthline + Veridas | Up to €65M (equity + debt) | KYC, biometrics, fraud prevention |
| Clark | $11M seed ($16M total) | AI audit employees for CPA firms |
| AvalonX | Up to $10M | AI pen testing for SMBs |
Sources are linked in the Deal Desk above. Currencies shown as reported.
Only 12% of startup trust pages say when they were last updated
A trust page with no date makes reviewers wonder how stale it is. A "last reviewed" line costs nothing and puts you ahead of 88% of the sample. Full data in We Analyzed 111 Startup Trust Centers.
Find and compare every tool mentioned this week in the Compliance AI Scout directory.