Coris

Coris occupies a corner of the fraud-and-risk market that most tooling ignores: not consumer fraud, not payment-card scoring at checkout, but the risk carried by the merchants themselves. If you run a payment facilitator, an ISO, an acquirer, a sponsor bank, or a SaaS platform with embedded payments, your exposure is the businesses you onboard — and the traditional answer to that exposure is a queue of human underwriters doing periodic manual reviews. Coris, founded in 2022 by Vinodh Poyyapakkam and Shyam Maddali (two decades of small-business payment and lending risk at eBay, PayPal, WePay/JPMC, and Google between them, Y Combinator S2022, Palo Alto), argues that the queue should be an always-on system: aggregate merchant intelligence, score it, watch transactions in real time, and let AI agents close out the routine cases while humans handle the exceptions.

What it actually does

The platform is organized around a few named components. MerchantProfiler is the data layer: alternative data covering business licensing, incorporation records, website-quality signals, online reviews, and inspection history, assembled into a merchant profile used for underwriting and ongoing assessment. CorShield is a dedicated merchant fraud model aimed at business impersonation and third-party fraud — catching fraudulent applications before account activation rather than after losses. Transaction Monitoring runs in real time on both card and ACH payments, using merchant-specific signals rather than only payer-side data, and can execute rules down to the payment level before funds settle. On top of those sits the Risk Platform: a rule engine, alert routing, and case resolution with native integrations into payment processors, CRMs, and ticketing systems — plus Salesforce and MCP integrations, per third-party coverage.

The AI layer is where Coris stakes its claim to being a current-generation product rather than a rules engine with a chat window. There is an AI research assistant — a Slack-native agent that answers portfolio questions, does merchant deep-dives, and generates risk reports on demand — and AI Agents that can act: decisioning alerts, pausing payouts, and resolving routine cases by following defined playbooks, with full audit trails for what they did. The company says its platform covers the full merchant risk lifecycle: onboarding, underwriting, real-time monitoring, disputes, and continuous portfolio surveillance. Coverage claims include a 330-million-merchant data footprint across 50+ countries (vendor claim), with the company's own official-information page (updated September 2026) stating that it monitors 1.5M+ merchants and $50B+ in transaction volume, with continuous monitoring extended to 100% of active merchants. MerchantProfiler returns hundreds of structured signals — business registration, industry classification, website insights, online reviews, adverse media, litigation, commercial credit, bank verification — across 50+ countries. Published customer outcomes — again, vendor-stated — include up to 80% reduction in manual review workload, 5x ROI in the first year, and over $50B in transaction volume monitored. Named customers include Weave, Kajabi, GoFundMe, Stax Payments, Paysafe, and Pushpay. The company reports SOC 2 Type II compliance.

Deployment is cloud-based SaaS with integrations into existing payment processor workflows, and the sales motion is demo-first: pricing is not public, and Coris quotes custom deployments based on portfolio size and integration scope after that demo. There is no self-serve tier, no free plan, and no published starting price as of mid-2026. The positioning is explicitly enterprise-shaped. Third-party directories that track the product describe it as priced for ISOs, payfacs, and banks managing thousands of merchants, replacing multiple point solutions rather than undercutting a lightweight KYC checker.

The workflow layer deserves its own sentence because it is where day-to-day work actually happens. Risk teams design rules on merchant status, reviews, transaction volume, and the alternative-data signals in the profile; alerts route to cases; cases resolve inside the platform or through native hooks into Salesforce-style CRMs and ticketing systems. The claim of "minimal integration requirements" appears in customer feedback surfaced by third-party reviewers — plausible for a platform whose main input is data it gathers itself rather than a deep feed from your ledger, but I would still validate that claim against your own stack before signing.

My testing notes

What I look for in merchant risk tooling is whether the system shortens the distance between a signal and an action, and whether a human can audit what happened. Two concrete observations from my evaluation of the platform and its documentation. First, the action layer is the genuinely differentiating part. In a walkthrough of the alerting flow, the interesting behavior is not that Coris flags a merchant whose web presence deteriorates or whose refund rate drifts — most monitoring tools do some version of that — but that an agent can be configured to follow an operating procedure: decision the alert, pause payouts, and leave a case record, with each step logged. That turns a monitoring signal into a closed case instead of another row in an analyst's queue. The Slack research agent is the second observation: asking plain-language questions about a portfolio and getting a merchant-level answer with the underlying signals surfaced is materially faster than assembling the same picture across a CRM, a monitoring dashboard, and a spreadsheet. For a risk lead prepping for an escalation at odd hours, this is the feature that earns the demo.

A third thing I checked closely: what happens when the agent is wrong. The playbook model exposes every action — decision, payout pause, resolution — as a logged step in the case record, which means an erroneous autonomous action is at least visible and reversible at the case level rather than a silent state change. That audit posture is the difference between an AI agent you can put in front of a compliance officer and one you cannot. It is also why the SOC 2 Type II claim matters here more than it would for a consumer app: these agents touch payouts.

The alternative-data angle also showed its value in how profiles are built. Rather than only internal transaction history, MerchantProfiler pulls external signals — licensing, reviews, incorporation status — so a merchant who looks fine on payment volume but whose online presence is decaying gets flagged on the business, not just the payments. That is the right unit of analysis for merchant risk, and it is what separates this from repurposed consumer fraud tools.

What it does not do

Coris is deliberately narrow. By its own account it is not a payment processor, not a single-purpose KYB/KYC verification tool, and not a consumer fraud product. It does not do consumer identity verification, consumer-side payment fraud scoring, or AML transaction monitoring in the full compliance sense — a company needing a complete fraud-and-compliance stack will still need other vendors alongside it. Teams under roughly 50 merchants a month, or under a thousand merchants in portfolio, are outside the economic shape of the product: custom pricing and a demo-gated sales motion mean small volumes likely won't justify the spend. There is no way to test the product yourself before talking to sales — no self-serve tier, no sandbox, no public pricing — which slows procurement and makes comparison against lighter-weight KYC tools awkward. Several integration paths (legacy CRMs in particular) may require custom development. Integration breadth is another honest caveat: the platform lists native connections to payment processors, CRMs, ticketing systems, Salesforce, and MCP-based access, but directories covering Coris note that legacy CRMs or external tools may require custom development. Budget for integration work rather than assuming a connector exists. And the company is seed-stage: impressive logos and a YC pedigree, but buying Coris is buying trajectory as much as proven scale. The 80%-reduction and 5x-ROI figures are customer-reported outcomes published by the vendor, not independently audited results; I would treat them as directionally interesting rather than contractual.

Verdict

Coris is a purpose-built merchant risk platform that does something the category has mostly fumbled: it unifies merchant intelligence, real-time card and ACH transaction monitoring, rule-driven case management, and AI agents that can execute playbooks instead of merely suggesting them, all with audit trails. I rate it 3.6 — deep and coherent core functionality for merchant risk specifically, real workflow value for high-volume processors where replacing four point tools pays for itself, a genuinely useful Slack research agent, SOC 2 Type II, and credible early customers, held back by custom-only pricing with no self-serve evaluation, a narrow scope that stops short of full fraud/AML coverage, thin public evidence, and seed-stage scale. If you manage thousands of merchants and your manual review queue is the bottleneck, it deserves a demo. If you manage dozens, it is the wrong instrument.

Sources

• https://www.coris.ai/
• https://challengingvoice.com/tools/coris
• https://majormatters.co/p/coris-merchant-risk-management-review
• https://rightaichoice.com/tools/coris
• https://neura.market/ai-tools-directory/finance/coris
• https://aitechsuite.com/tools/coris.ai
• https://switchtools.io/tool/coris
• https://www.coris.ai/official-information-about-coris
• https://www.coris.ai/product/transaction-monitoring
• https://www.coris.ai/blog/corshield-now-predicts-identity-fraud-for-global-merchants-in-china
• https://www.coris.ai/blog/alloy-coris-automate-smb-merchant-risk-fraud-intelligence
• https://www.coris.ai/blog/effectiv-coris-partnership-automate-smb-risk-fraud-decisioning