- Digital banking giant protects 131M+ customers across Latin America.
- DefenseIO team processes 450 million events and 5 million requests per minute.
- Transitioning from code-based to declarative fraud policies for speed and autonomy.
- Leveraging AI agents and plugins for next-generation fraud detection.
In an era where digital transactions are the norm, financial institutions face an ever-evolving landscape of fraud. Nubank, one of the world's largest digital financial services platforms, is at the forefront of this battle. At the recent AWS FSI NYC 2026 conference, Jairo and Daniel from Nubank's DefenseIO team shared their strategies for scaling fraud detection to an astounding 450 million events daily, detailing their journey from decentralized defenses to an AI-powered, declarative ecosystem.
Nubank's impressive scale speaks for itself: over 131 million customers globally, with more than 62% of Brazil's adult population using their services. This massive user base necessitates a robust and highly scalable fraud detection system. The DefenseIO team, comprising engineers, ML engineers, and data scientists, is responsible for building and maintaining the core fraud prevention platform. This platform, built on Clojure, Datomic over DynamoDB, Kafka, and Python for ML models, acts as the central engine for executing fraud protections across various business units, from card issuing to lending and e-commerce.
The evolution of Nubank's fraud detection has been a journey of centralization and automation. Initially, fraud logic was decentralized and embedded directly into product services, leading to duplicated and inconsistent policies. The first major step was to centralize this logic into a single Clojure-based infrastructure. While this improved consistency, it still required significant engineering effort for every policy change. The pivotal shift came with the adoption of a declarative ecosystem, introducing a policy engine and a policy registry. This innovation allows business owners and fraud teams to configure defenses in real-time via a user interface, bypassing lengthy deployment cycles and dramatically accelerating response times to emerging fraud patterns.
Looking ahead, Nubank is actively adapting its platform for the AI era. The goal is to integrate AI agents for rule creation while maintaining strict control to prevent issues like model hallucinations. This involves optimizing token usage and creating unified AI interfaces, allowing customers to interact with the platform using their preferred AI clients. The DefenseIO team has developed an 'agent plugin' – a combination of prompts and an MCP (Multi-Agent Control Plane) – to guide AI tools, ensuring they adhere to defined rules and instructions, simplifying the process for internal users.
However, scaling to billions of transactions and incorporating AI brings new challenges: security, scalability, and quality. Ensuring that only authorized individuals or agents create rules, and that these rules don't inadvertently block legitimate transactions, is paramount. The team emphasizes rigorous measurement of rule behavior, business impact, and operational performance to maintain top-tier quality. Nubank's commitment to a declarative, AI-augmented approach, coupled with a focus on these critical challenges, positions them to continue safeguarding their rapidly growing customer base.
“We want to make sure that they follow the rules that we have created and the set of actions that we have defined for our rules. So, to ensure that we want to continue in the declarative growth not not only for our rules, but in general make sure that we can change configurations and we have more control over the protections that we have for our customers.”
