If your bank runs BioCatch, you have until roughly 31 March 2027 to decide what your contract says about the buyer. Visa announced on 3 August that it is acquiring BioCatch for $2.4 billion in cash, with the deal expected to close "by the end of Visa's fiscal second quarter of 2027." BioCatch watches how your customers type, swipe and hold their phones, and it does that inside more than 350 banks across 21 countries — including, per Biometric Update's reporting, three of the four largest US banks by assets.
Neither company's announcement contains the word banks actually care about. Not "neutral." Not "network-agnostic." Not "will continue to serve institutions regardless of payment network." Visa's release and BioCatch's release are both silent on continued service terms, data rights and standalone pricing. The closest thing to a commitment sits in a same-day blog post from BioCatch CEO Gadi Mazor — "we will continue to serve the same financial institutions the same way we always have," with the leadership team and reporting structure kept intact — which is a statement of intent carrying no term, no scope and no mention of payment networks. None of this is evidence of bad intent. It is evidence that the question has not been answered yet — which is exactly why the next eight months are the only period in which you have leverage over the answer.
What Visa Actually Bought
Visa bought the behavioral telemetry layer that sits between a bank's customer and any payment, on any network. BioCatch continuously collects, in Visa's own description, "more than 3,000 anonymized data points — keystroke and mouse activity, touch screen behavior, AI agent usage, jailbroken devices, and more." Behavioral biometrics is identity inference from how a session is conducted rather than what credential was presented: the cadence of typing, the arc of a cursor, whether the person filling in a transfer form has done it a hundred times before or is being coached through it by a stranger on the phone.
The scale numbers are Visa's and BioCatch's own: 1.8 billion devices, 760 million users, more than 100 of the world's largest banks, and 19 billion user sessions analysed monthly. On the money, BioCatch finished 2025 at $185 million in annual recurring revenue per Biometric Update, which puts the headline price at roughly 13x trailing ARR. American Banker reports that KeyBanc analysts model 2027 revenue of $260–280 million and call the multiple "reasonable" at about 9x forward — and it names Wells Fargo among the top-four US banks running the software.
Note who is selling. Permira completed its acquisition of a majority position in BioCatch at a $1.3 billion valuation in September 2024, when the company had passed $100 million ARR, reached EBITDA profitability in 2023 and grown ARR 43% year-on-year in the first half of 2024. Visa is paying 1.8x that valuation less than two years later. This is a financial sponsor exiting into a strategic buyer at the top of a fraud-spend cycle, which tells you the seller had no structural reason to negotiate protections on your behalf.
The Sentence That Isn't in Either Announcement
The missing commitment is that BioCatch stays available, on comparable terms, to institutions that route volume on competing networks. American Banker frames the change precisely: once the deal closes, "the U.S. banks running BioCatch will buy their fraud detection from a company with which they also negotiate card terms."
That is the whole problem in one sentence, and it does not require anyone at Visa to act badly. Two commercial relationships that were independent become one. Your interchange negotiation and your fraud-detection renewal now sit across the table from the same counterparty, and the party with a $2.4 billion asset to monetise gets to decide how tightly those two conversations are coupled.
Steel-man the other side, because it is a real argument. Fraud detection genuinely works better with more signal, and Visa sees the transaction side of a session that BioCatch does not. The stated rationale from Andrew Torre, Visa's president of value-added services — "account takeovers and scams cost the global economy over $1 trillion annually and AI is enabling these attacks at unprecedented scale" — is not marketing; it is the reason banks bought BioCatch in the first place. Visa also says it has invested more than $13 billion in payments-security technology and infrastructure over five years, which is more than BioCatch could ever have spent alone. A better-funded BioCatch with network-level context is a plausible outcome, and for a Visa-heavy issuer it may be a straightforwardly good one.
The point is not that the bad outcome is likely. The point is that the good outcome is currently a hope, and hopes are not contract terms. Enterprise buyers have learned this repeatedly this summer — when Anaconda bought Enkrypt AI, the question was whether a red teamer stays independent of the platform that now owns it; when d-Matrix bought Wallaroo, it was whether "any hardware" survives ownership by a hardware vendor. It is the same shape every time, and the answer is always whichever one is written down.
Featurespace Is the Precedent, and It Cuts Both Ways
Visa has already run this play once, and the outcome so far is genuinely reassuring on product and genuinely unhelpful on independence. Visa completed its acquisition of Featurespace — a bank-facing fraud and financial-crime platform whose clients included NatWest — in December 2024 for roughly $950 million, and folded it into the Risk and Identity Solutions unit. Three months later, Visa announced that Featurespace's ARIC Risk Hub was live globally as part of a portfolio of "more than 200 value-added services," alongside the statement that "multi-network services operate beyond Visa in an open, 'any-payment' ecosystem" — a line that describes the value-added services portfolio as a whole, not ARIC specifically.
So the good news is real: Visa kept a bank-facing fraud product selling to banks, and publishes open-ecosystem language over the portfolio that product sits in. If you want a precedent for BioCatch surviving as a standalone product, that is it.
Now read the second half. Featurespace did not stay a standalone company — it became a line inside value-added services, and value-added services is Visa's fastest-growing business. In fiscal Q3 2026, reported 28 July, value-added services revenue was $3.8 billion, up 34% in constant dollars, against total net revenue of $11.6 billion. Roughly a third of Visa's revenue now comes from the bucket your fraud vendor is about to be dropped into, and it is growing more than twice as fast as the company overall.
That is the actual commercial risk, and it is duller than a conspiracy: bundling. As American Banker puts it, bundling is often more efficient and makes vendor management easier — in the words of Eric Grover of Intrepid Ventures, "albeit at the cost of reducing banks' negotiating leverage." A product inside a 200-service portfolio gets priced as part of that portfolio. Standalone pricing, standalone SLAs and standalone termination rights are things you keep only if you ask for them while someone still needs your signature.
Worth remembering that Visa did not need to own a behavioral-biometrics vendor to resell one: back in October 2021 it selected Callsign as its primary behavioral biometrics and device-fingerprinting provider for European financial institutions through a partner program. Partnership was the available structure. Visa chose ownership instead.
The Australian Network Is the Sharpest Version of the Question
The hardest data-governance question in this deal is not about one bank's telemetry — it is about the pooled kind. In November 2024, BioCatch launched BioCatch Trust Australia with ANZ, Commonwealth Bank, NAB, Suncorp Bank and Westpac as founding members: an inter-bank network that exchanges behavioural intelligence, digital session data, payment information, account details and device intelligence so a sending bank can score the receiving account before money moves. A second network went live in Argentina with Banco Galicia, Naranja X and Santander.
Five competing Australian banks agreed to pool customer behaviour into a shared pot because the operator was a neutral third party. Change the operator to a payment network and you have changed the premise of the arrangement, whatever the pseudonymisation architecture says. Asked by American Banker whether it intends to extend BioCatch Trust to the US, Visa did not respond.
If you are a member of one of those networks, your questions are specific and they are not about Visa's good faith: does the consortium agreement survive change of control, who is the data controller after close, can pooled intelligence inform any Visa product outside the network, and what is the unwind procedure if members want out. If you are not a member, note the mechanism anyway — this is how an AI-driven fraud consortium becomes payment-network infrastructure, and it is the same consolidation logic we saw when Okta bought Permiso and the independent layer became a feature of the platform above it.
Switching Is a Weak Threat, and Visa Knows It
The reason to negotiate now is that "we'll move to a competitor" stopped being credible several acquisitions ago. Trace the category:
| Year | Vendor | Acquirer |
|---|---|---|
| 2017 | NuData Security | Mastercard |
| 2021 | Revelock | Feedzai |
| 2022 | BehavioSec | LexisNexis Risk Solutions |
| 2026 | BioCatch | Visa |
Mastercard took NuData in 2017 and folded it into its fraud-management suite. Feedzai absorbed Revelock in 2021. LexisNexis Risk Solutions took BehavioSec into its ThreatMetrix line in 2022. BioCatch was the last behavioural-biometrics vendor operating at bank scale without a payments or data conglomerate above it, and after March it will not be. Callsign, Darwinium and ThreatMark remain independent, but none of them is running 19 billion sessions a month for 100 of the world's largest banks.
This is the concentration problem regulators have already named. American Banker cites the Financial Stability Oversight Council's 2025 annual report: trouble at a significant third-party provider can reach many institutions at once, "particularly where there is limited substitutability." Limited substitutability is now the defining feature of this category, and it is the reason your leverage is procedural — change-of-control clauses, assignment consent, audit rights — rather than competitive.
The demand side is not softening either. The UK's mandatory reimbursement regime for authorised push payment fraud took effect on 7 October 2024 with victim cover up to £85,000, and an independent Frontier Economics evaluation published by the Payment Systems Regulator on 1 July 2026 found APP fraud losses through Faster Payments down roughly 21% — about £73 million a year — while reimbursement rates rose from 54% of claims before the rules to 65% after, and firms now reimburse 97% of claims that fall inside the policy's scope. When the regulator makes the sending bank pay for nearly every in-scope claim, behavioural detection stops being a security line item and becomes a loss-provision line item. That demand shift is a large part of why this asset cleared 13x ARR, and why nobody is going to discount it for you out of goodwill.
What Regulators Will and Won't Do for You
Do not plan around an antitrust challenge. The last time Visa tried to buy a company sitting between banks and payments, it lost: the DOJ sued in November 2020 to stop the $5.3 billion Plaid acquisition, arguing it would extinguish a nascent competitor and entrench Visa's online debit dominance, and Visa and Plaid terminated the deal on 12 January 2021 after about a year of pendency.
BioCatch is a different animal. Plaid was a potential competitor to Visa's debit business; BioCatch is a supplier of a service Visa already sells. The nascent-competitor theory that killed Plaid does not obviously apply, and vertical deals are harder to block than horizontal ones.
That said, Visa is not entering this review with a clean slate. The DOJ's monopolization suit over US debit — filed September 2024, alleging Visa processes more than 60% of US debit transactions and collects over $7 billion a year in processing fees — survived Visa's motion to dismiss in June 2025, with Judge John Koeltl finding the government's allegations plausible. A live Section 2 case does not block an unrelated acquisition, but it does mean an eight-month regulatory window is a realistic assumption rather than a pessimistic one — and that window is your negotiating clock, not a reason to wait.
Even in the unlikely event of a challenge, note what happened to Plaid's customers during the year the deal was pending: nothing, and then the deal died and they still had to renew. Regulatory uncertainty is not a substitute for a contract term.
What to Do Before Close
This Week:
- Pull the BioCatch master agreement and find the change-of-control and assignment clauses. Read whether consent is required, whether it is deemed given, and whether there is a successor carve-out. Ten minutes of reading determines whether you have a right or a request.
- Establish whether you are in scope for BioCatch Trust. If you are an Australian or Argentine member institution, your exposure is the consortium agreement, not just your own licence, and the two may have different change-of-control language.
- Write down what BioCatch actually holds on your customers. Session telemetry, device intelligence, behavioural profiles, retention period, storage region. You cannot negotiate data rights you have not inventoried.
This Quarter:
- Send a written diligence request to your BioCatch account team, with a date. Four questions: will service continue on current terms after close; will pricing remain standalone rather than bundled into value-added services; can our behavioural data be used to train or inform any Visa product outside our contract; and what is the notice period if the product is repositioned. Get answers in email, not on a call.
- Price the alternative even though you will not use it. Get an indicative quote from Callsign, Darwinium or ThreatMark and a rough migration estimate from your fraud engineering lead. A number on paper is what converts an empty threat into a negotiating position.
- Loop in whoever owns your Visa network relationship. If those two conversations are held by different people who never speak, the coupling risk is real inside your own organisation before it is real at Visa's.
Before Close (31 March 2027):
- Get four terms in writing as a condition of your next renewal: continued service at standalone pricing for a defined term; an explicit prohibition on your telemetry informing network-level models outside the contract; audit rights over data use post-close; and a termination-for-convenience right with data return in a documented format, triggered by material repositioning of the product.
- Do not sign a multi-year renewal that lands before close without those terms. A renewal signed now is the last piece of leverage you will spend, and spending it for a discount is the trade you will regret.
The Bottom Line
Every vendor consolidation story this year has the same structure: a capability you bought because it was independent gets absorbed by a platform whose interests only partly overlap with yours, and the acquirer's press release is silent on the one term that mattered. It was true when SpaceX bought Cursor and enterprise development tooling lost its neutrality, and it is true here — except that in banking the absorbed capability is watching your customers' hands, and the absorbing party also sets your interchange.
Visa may well run BioCatch exactly as it has run Featurespace: multi-network, openly sold, better resourced. That would be the good outcome, and it is a plausible one. But that "any-payment" language is a portfolio description Visa published in April 2025, not a product commitment, and it cuts both ways: BioCatch is joining the very portfolio it covers, so Visa can fairly argue the umbrella already extends — and you would still have nothing that names BioCatch, your contract or your renewal date. Between now and March, someone at Visa has to decide what the specific sentence says. The banks that ask, in writing, with a renewal date attached, are the ones who get to influence it.
Eight months of leverage is a lot. It is also all you get.
Continue Reading
Visa's 4-Protocol Bet: AI Agents and the $5T Market
Cursor Lost Its Neutrality: The $60B Risk for Enterprises
Anaconda Bought Your AI Red Teamer. Read the License.
Bending Spoons Bought Airtable. Reprice Before It Closes.
Okta Bought Permiso. Your Leverage Expires Oct 31.