Cleafy

Digital banking fraud no longer looks like it did a decade ago. Gone are the crude phishing emails and obvious scam pages. Today's attacks leverage sophisticated malware embedded in mobile banking apps, trojans that intercept user sessions in real time, and man-in-the-browser techniques that silently manipulate transactions under victims' eyes without leaving obvious traces. It was against this backdrop that Emanuele Paccamiccio, Matteo Bogana, and Lorenzo Asuni founded Cleafy in Milan in 2014, with a precise thesis: banks needed an intelligence layer capable of reading the entire user session — not just individual events. What sets Cleafy apart from traditional security solutions is exactly this holistic approach. While conventional systems analyze isolated transactions or point-in-time signals, Cleafy's platform builds a complete behavioral model of the entire session — from the moment a user opens a banking app to when the connection closes. This makes it possible to detect fraud patterns even when no single event, taken in isolation, would be enough to trigger an alert. The solution is device-agnostic, integrates into existing banking infrastructure without requiring any software installation on end users' devices, and operates in real time across mobile and web banking channels simultaneously. The market response has been unambiguous. Cleafy now serves over 150 financial institutions across Europe and Latin America, protecting a base of more than 250 million end users. Clients include ING, Illimity, BPS Suisse, and the BCC Iccrea Group — names that attest to the trust of institutions with extremely rigorous due diligence standards. The team has grown from 5 to approximately 100 people over a decade, operating across four hubs: Milan, London, Barcelona, and Bogotá, reflecting a genuinely international operational structure. In March 2026, Cleafy closed a €12 million Series B round co-led by United Ventures and eCAPITAL, bringing total funding raised to €22 million. The timing is deliberate: the implementation of the Digital Operational Resilience Act (DORA) and the tightened NIS2 cybersecurity requirements are forcing European banks to substantially raise the bar for their digital resilience. Cleafy positions itself as one of the preferred tools for meeting these regulatory obligations, turning compliance from a passive requirement into a competitive advantage. Cleafy's approach also challenges a deeply embedded assumption in banking: that security is a cost center to be minimized. The platform reframes fraud detection and prevention as a driver of customer trust — with measurable effects on retention and user satisfaction. A bank that can protect its customers in real time isn't just offering security; it's delivering a promise of reliability that translates into longer, deeper relationships. The 2026 roadmap is centered on predictive artificial intelligence — moving from reactive detection to anticipating attack patterns before they cause harm — and on expanding into Latin American banking markets, where financial services digitization is accelerating rapidly but security infrastructure is struggling to keep pace. The combination of a technically elite team, a consolidated client base, and a favorable regulatory tailwind makes Cleafy one of the most compelling assets in European fintech cybersecurity. What makes Cleafy's trajectory particularly notable is the alignment between product maturity, regulatory momentum, and market timing. The DORA framework, which became fully applicable in January 2025, doesn't just encourage banks to invest in real-time fraud detection — it effectively mandates it. For institutions that had been treating digital security as a discretionary investment, the regulation has transformed Cleafy from a nice-to-have into a compliance necessity. That shift in positioning — from optional tool to regulatory infrastructure — is one of the most powerful growth engines a B2B software company can have, and Cleafy is positioned at its center.