V-DIG Audit — Aviva plc

Audit Phase: V-DIG (Digital Forensics / Technology Supply Chain) Date: 2026-05-01 Scope: Aviva plc and its wholly-owned UK operating subsidiaries, including Aviva Life & Pensions UK Limited and Aviva Investors Global Services Limited. The divested Singapore joint venture (formerly “Singlife with Aviva”) is out of scope.

Enterprise Technology Stack & Vendor Relationships

Confirmed Israeli-Origin Software Deployments

Verint Systems — Confirmed, Operational

Verint Systems (NASDAQ: VRNT; incorporated in Melville, NY; R&D centre in Herzliya, Israel, where the company originated as part of Comverse Technology) is the single most thoroughly evidenced Israeli-origin technology vendor in Aviva’s documented stack.

Three Verint-published primary sources confirm the deployment in Aviva Life (UK):

A Verint case study page ¹ and accompanying PDF ² describe Aviva Life’s deployment of Verint Speech Analytics within its UK contact centre operations. The stated purpose is call recording, phonetic search, keyword spotting, sentiment detection, and the identification of customers requiring additional support under FCA Consumer Duty obligations. The PDF confirms processing of over 3 million calls per year and approximately 330,000 hours of audio annually ².
A second Verint case study ³ documents Aviva achieving an 85% increase in Net Promoter Score (NPS) and improved regulatory compliance outcomes using the Verint Speech Analytics platform ³.
The Verint case study PDF explicitly references the creation of automated “watchlists” used to flag and route calls from customers identified as potentially vulnerable, integrating sentiment and keyword outputs into Aviva’s operational workflows ².

Operational significance: Verint’s platform is embedded in Aviva’s customer-facing contact centre infrastructure, not a peripheral or experimental deployment. Processing volumes of 3 million+ calls per year across UK Life operations indicate deep integration into daily customer service, regulatory compliance (Consumer Duty), and quality assurance workflows ¹²³.

Verint’s Israeli nexus: Verint Systems Ltd (Herzliya, Israel) is Verint’s principal R&D subsidiary. Verint traces its commercial origin to the intelligence-sector division of Comverse Technology, an Israeli-founded company. Verint’s surveillance and analytics technology has been subject to separate civil society scrutiny in other contexts; within the Aviva deployment the use case is commercial contact centre analytics.

Confirmed Commercial Relationships with Israeli-Founded Entities

Lemonade — Confirmed, Ongoing (Reinsurance Capacity, Not Technology Procurement)

Aviva entered a reinsurance partnership with Lemonade, Inc. (NYSE: LMND) in 2022 to support Lemonade’s entry into the UK home insurance market ⁴⁵. Multiple sources confirm the structure: Aviva acts as reinsurer, providing risk capacity for Lemonade’s UK home insurance book ⁴⁵.

A Business Wire announcement dated 16 July 2024 confirms the relationship remained active and that Lemonade expanded its UK home insurance offering under the same arrangement ⁶.

Important qualification: This is a reinsurance/capacity provision agreement, not a technology procurement or software licensing contract. Aviva is not a customer of Lemonade’s AI underwriting platform; it is a capital and risk partner. Lemonade is incorporated in Delaware (US); its R&D and founding team are based in Tel Aviv. The relevance to a technology supply chain audit is limited: Aviva does not receive, deploy, or integrate Lemonade’s proprietary AI/ML infrastructure under this arrangement ⁴⁵⁶.

Major System Integrator & Platform Relationships

Tata Consultancy Services (TCS) — Confirmed Strategic Partnership

TCS is Aviva’s most operationally significant external technology partner by documented policy volume. Trade and business press confirm that TCS manages over 6.5 million Aviva UK policies under its BaNCS platform ⁷⁸. In January 2024, TCS and Aviva announced a 15-year extension of this strategic partnership ⁸.

The scale of this relationship — 6.5 million policies under management, a 15-year contractual horizon — makes TCS the dominant integrator in Aviva’s UK life and pensions administration infrastructure ⁷⁸.

No public evidence was identified that TCS has embedded specifically Israeli-origin sub-supplier technology as part of the Aviva engagement, nor that the BaNCS platform incorporates Israeli-domiciled components. This gap is noted; TCS’s own technology sub-contracting disclosures for the Aviva contract are not publicly filed ⁷⁸.

Microsoft — Confirmed Cloud Relationship

A Microsoft-published case study document confirms Aviva’s use of Microsoft cloud services ⁹. Microsoft is a US company. No Israeli-origin technology embedded specifically via Microsoft in the Aviva relationship is identified beyond the general infrastructure point addressed in the Cloud section below ⁹.

Unverified Claims — Israeli-Origin Security Vendors

The following vendors were asserted by prior analysis as components of Aviva’s security stack. None can be confirmed from accessible primary sources. The specific source citations offered in prior analysis were found to be mislabelled or unrelated to Aviva. These findings are reported in full for transparency.

CyberArk (Petach Tikva, Israel): Job board listings referencing “CyberArk Enterprise Password Vault (EPV)” and “Privileged Session Manager (PSM)” as required skills at Aviva were cited in prior analysis ¹⁰. Job board postings are ephemeral and cannot be re-verified post-expiry. The 2009 CyberArk press release cited in prior analysis as confirming Aviva’s customer status is a generic milestone announcement that does not name Aviva ¹⁰. CyberArk is widely deployed across UK financial services; job posting references are consistent with, but not confirmatory of, an enterprise contract. No public evidence identified of a confirmed, named Aviva–CyberArk procurement relationship.

Wiz (Tel Aviv, Israel): A senior security engineer job posting at Aviva was cited in prior analysis as listing Wiz and Prisma Cloud as required proficiencies. Job postings are ephemeral. The Check Point/Wiz partnership press release cited in support ¹¹ does not mention Aviva. No public evidence identified of a confirmed, named Aviva–Wiz procurement relationship.

Check Point Software Technologies (Tel Aviv, Israel): The prior characterisation of Check Point as the “foundational layer” of Aviva’s network defence is not supported by any named primary source. The cited source ¹¹ is a Check Point/Wiz partnership press release that makes no reference to Aviva. No public evidence identified.

SentinelOne (Mountain View, CA; Israeli co-founders): The cited sources in prior analysis for SentinelOne’s presence at Aviva were found to reference a job listing for an entirely different company (Hyperexponential). No public evidence identified.

Palo Alto Networks / Prisma Cloud: Cited only via ephemeral job posting references alongside Wiz. No public evidence identified beyond unverifiable expired listings.

Surveillance, Biometrics & Retail Technology

Voice Analytics & Behavioural Surveillance — Confirmed

The Verint deployment described above constitutes the substantive finding in this section. The operational characteristics of the deployment as documented in Verint’s own case study materials merit specific attention in the surveillance context:

Automated sentiment detection applied to all recorded customer calls in Aviva Life’s UK contact centre ¹².
Keyword spotting and phonetic search across the full corpus of recorded audio, enabling retrospective and real-time query of call content ².
Automated watchlist generation: Customers meeting defined behavioural or linguistic criteria are flagged and categorised as potentially vulnerable, creating persistent classifications derived from voice call analysis ².
Processing scale: 3 million+ calls per year, 330,000 hours of audio ².
Stated regulatory justification: FCA Consumer Duty compliance; identification of customers at risk ¹²³.
NPS and compliance outcomes: Aviva reports an 85% NPS improvement and improved compliance metrics attributable to the platform ³.

The Verint platform performs continuous automated behavioural analysis of Aviva’s UK Life customer base through voice call content. This is a material surveillance capability embedded in routine customer service operations. The regulatory framing (Consumer Duty, vulnerable customer protection) is the stated business justification; the underlying technology capability extends beyond that framing.

Verint’s background in intelligence-grade surveillance: Verint Systems originated in Comverse Technology’s SIGINT business unit. Its core analytics technologies are dual-use: the same phonetic search, keyword spotting, and sentiment-detection capabilities used in commercial contact centres have documented intelligence and law enforcement applications. This does not imply misuse by Aviva; it is context relevant to technology provenance assessment.

Facial Recognition, Biometric Identity & Retail Technology

Aviva is not a retail operator. Vendors whose primary use cases are checkout-free retail, physical surveillance, or biometric access (Trigo, BriefCam, AnyVision/Oosto, Trax) have no documented relationship with Aviva. No public evidence identified for any such relationship.

Behavioural Biometrics — BioCatch

Prior analysis cited the Datos Insights Impact Awards recipients page ¹² and a reference to “Singlife with Aviva” as evidence that Aviva plc uses BioCatch. Neither citation withstands scrutiny:

The Datos Insights awards page ¹² lists award recipients across the financial services sector; it does not constitute confirmation that Aviva plc procured BioCatch.
“Singlife with Aviva” was a Singapore joint venture from which Aviva divested in 2020. It is out of scope for this audit of Aviva plc’s current operations.

No public evidence identified that Aviva plc (UK) currently deploys BioCatch or any comparable behavioural biometrics platform from an Israeli-origin vendor. This finding is distinguished from the confirmed Verint voice analytics deployment.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Cloud Platform Relationships

Aviva’s use of Microsoft Azure is documented in a Microsoft-published case study ⁹. Broader use of hyperscale cloud (AWS, Azure) is consistent with Aviva’s digital transformation disclosures in annual reports ¹³¹⁴¹⁵, though specific cloud spend by provider and region is not publicly itemised.

Israeli Data Centre Operations

Aviva’s disclosed data centre and hosting strategy references UK and European regions. No Israeli data centre, co-location facility, or hosting arrangement is referenced in Aviva’s 2022 or 2024 annual reports ¹³¹⁵. No public evidence identified of Aviva operating or contracting data processing infrastructure within Israel.

Project Nimbus

Project Nimbus is the Israeli government and IDF cloud contract awarded to Google Cloud and AWS. Aviva has no publicly documented role in Project Nimbus. Prior analysis argued, inferentially, that because Aviva uses AWS/Azure and those providers participate in Nimbus, Aviva is part of the “Nimbus ecosystem.” This is an analytical inference, not evidence of a direct contractual, operational, or commercial relationship with the Nimbus programme.

No public evidence identified of any direct Aviva relationship with Project Nimbus or comparable Israeli state cloud infrastructure programmes.

Sovereign Cloud & Data Residency Risk

Aviva’s annual reports ¹³¹⁵ confirm the company holds sensitive customer data subject to UK GDPR and FCA requirements. Data residency obligations are discussed in general terms; no evidence of Israeli jurisdiction data flows is identified. The Verint deployment involves processing of UK customer call audio; Verint’s hosting and data residency arrangements for the Aviva deployment are not specified in the publicly available case study materials ¹²³.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

Aviva is an insurance and financial services company. It is not a technology vendor, defence contractor, or surveillance system provider. No public evidence identified of any contract, partnership, or service agreement between Aviva plc and the Israeli Ministry of Defence, the Israel Defense Forces, or Israeli intelligence agencies (Mossad, Shin Bet, Unit 8200 affiliated entities).

Dual-Use Technology

No public evidence identified that Aviva’s commercially procured technology has been reported as deployed for military, intelligence, or law enforcement surveillance in Israel or the Occupied Palestinian Territories. The Verint platform’s dual-use heritage is noted in the surveillance section above; there is no evidence that Aviva’s specific deployment configuration or data flows are connected to Israeli state security operations.

Offensive Cyber Capabilities

Aviva develops no offensive cyber capabilities. It is a buyer and user of commercial technology, not a vendor. No public evidence identified of any offensive cyber technology development, sale, or licensing by Aviva.

Elbit Systems — Investor Relationship (Aviva Investors)

The civil society scrutiny section addresses Aviva Investors’ potential holdings in Elbit Systems through its fund portfolios. This is an investment relationship, not a technology or defence contracting relationship. The two dimensions are structurally distinct.

AI, Algorithmic & Autonomous Systems

Confirmed AI/ML Deployments with Israeli-Origin Technology

The Verint speech analytics platform, confirmed as deployed in Aviva Life UK ¹²³, incorporates machine learning components for sentiment classification, keyword detection, and behavioural pattern recognition applied to customer voice call data. This is the only confirmed deployment of an Israeli-origin AI/ML system in Aviva’s documented stack.

Lemonade’s AI/ML Platform

Lemonade’s proprietary AI underwriting and claims adjudication systems, developed primarily by its Tel Aviv R&D team, are not deployed by or within Aviva’s operations. The reinsurance partnership means Aviva receives risk/capacity flow, not access to or deployment of Lemonade’s AI infrastructure ⁴⁵⁶.

AI Provision to Israeli State Bodies

No public evidence identified.

Training Data & Model Governance

No public evidence identified of Aviva AI models trained on, or provided access to, data collected from Israeli or Palestinian civilian populations. Aviva’s AI governance disclosures in annual reports address algorithmic fairness in an insurance underwriting context within UK regulatory frameworks ¹³¹⁵.

Aviva Quantum / Academic Engagement

Prior analysis cited the University of Cambridge talks.cam archive ¹⁶ in connection with Aviva Quantum staff attendance at seminars as evidence of a technology relationship. Seminar attendance is not evidence of a commercial or procurement relationship. The raw attendance facts, if confirmed by the talks.cam records ¹⁶, would be factual but would not constitute a vendor relationship. No confirmable commercial implication is established by this citation.

Autonomous Systems & Lethal Technology

No public evidence identified. Aviva has no documented involvement in autonomous weapons, lethal decision systems, or defence-grade autonomous technology.

Technology Ecosystem & R&D Footprint

R&D Presence in Israel

No public evidence identified of Aviva operating an R&D centre, engineering office, innovation laboratory, or technology accelerator within Israel. Aviva’s documented technology and innovation operations are based in the UK and include the Aviva Services Excellence Centre in Poland ¹⁷.

Aviva Services Excellence Centre — Poland

Aviva operates a technology and services delivery centre in Poland ¹⁷. This facility supports UK operations across technology, finance, and customer service functions. No Israeli-origin technology mandate is documented in connection with this centre ¹⁷.

Startup Investments & Accelerator Programme

In July 2017, Aviva and Founders Factory announced support for five fintech startups under Aviva’s startup partnership programme ¹⁸. The announcement does not name any Israeli startups among the initial cohort. No more recent documentation of Israeli startup investments through this programme was identified ¹⁸.

An InsuranceERM interview with Aviva’s then-Chief Innovation Officer Ben Luckett references Luckett discussing innovative technology and mentioning a conversation with “a startup in Israel” in the context of risk management technology exploration ¹⁹. The startup is not named, no investment or procurement is confirmed, and the reference constitutes one executive’s reported verbal description of a market exploration conversation — not a confirmed commercial transaction ¹⁹.

No confirmed acquisitions of Israeli-origin technology companies by Aviva plc were identified.

Aviva Investors — Fund Holdings in Israeli-Domiciled Companies

Aviva Investors’ Investment Funds ICVC Interim Report and Financial Statements (April 2025) ²⁰ is a publicly accessible regulatory filing. Aviva Investors manages both index-linked and actively managed funds that hold diversified global equities.

Structural context: Holdings in Israeli-listed equities through MSCI World, FTSE All-World, or comparable global index funds are a mechanical function of index composition, not deliberate selection. This applies to most large UK institutional asset managers.

Prior analysis asserts that the April 2025 ICVC Interim Report ²⁰ contains holdings in Elbit Systems, Israel Discount Bank, First International Bank of Israel, Enlight Renewable Energy, Energix Renewables, and ICL Group. The ICVC Interim Report ²⁰ is the correct primary source class for this claim. The specific holdings could not be independently verified from a live fetch of the document in this session; the document exists and is the appropriate reference for direct verification.

Cross-referencing with NGO sources: Campaign Against Arms Trade ¹⁵ and War on Want ²¹ have documented UK institutional investors holding Elbit Systems shares; Aviva Investors has appeared in such analyses. ShareAction ²² has engaged Aviva Investors on ESG matters including weapons and occupation-linked holdings. These NGO sources are the appropriate cross-reference class for the Elbit Systems holding claim, pending direct verification of the April 2025 ICVC filing ²⁰.

Patent & Intellectual Property

No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between Aviva and Israeli-domiciled research institutions (Technion, Hebrew University, Weizmann Institute) or Israeli technology companies.

Civil Society Scrutiny & Regulatory History

NGO Research & Advocacy

ShareAction ²²: ShareAction has published research on UK institutional investors’ ESG exposures and engaged Aviva Investors directly on climate, labour standards, and responsible investment. Aviva Investors has been subject to ShareAction engagement and appears in ShareAction’s broader analysis of UK institutional investor ESG practices ²². No specific published ShareAction investigation focusing on Aviva’s Israeli technology vendor supply chain (as distinct from investment holdings) was identified.

Campaign Against Arms Trade — CAAT ¹⁵: CAAT maintains databases of UK institutional investors with defence sector holdings and has published analysis of UK pension and insurance funds holding shares in Elbit Systems and other defence companies. Aviva Investors has appeared in CAAT’s analysis of institutional defence sector exposure ¹⁵. No dedicated CAAT report specifically addressing Aviva’s technology procurement relationships with Israeli vendors was identified.

War on Want ²¹: War on Want has campaigned on UK institutional investors holding Elbit Systems shares, framing such holdings as complicity in occupation-related activities. Aviva Investors has been identified in this context ²¹. No dedicated War on Want report addressing Aviva’s technology vendor relationships was identified.

Palestinian solidarity and BDS-adjacent campaigns: No published NGO investigation specifically targeting Aviva’s technology supply chain relationships with Israeli technology vendors — as distinct from investment portfolio holdings — was identified in available source material. Civil society scrutiny of Aviva in this context has focused on the investment portfolio (particularly Elbit Systems exposure) rather than on enterprise technology procurement.

Aviva Investors’ Responsible Investment Response

Aviva Investors’ stewardship and responsible investment disclosures ²³²⁴ address ESG engagement in general terms, including arms sector stewardship and occupation-related concerns raised by civil society organisations. These disclosures do not specifically address Israeli equity holdings or BDS-related campaigns. No public Aviva response to civil society campaigns targeting its Elbit Systems or defence sector holdings was identified in accessible corporate communications ²³²⁴.

Boycott & Divestment Campaigns

Aviva Investors has been named in investor-focused BDS-adjacent campaigns relating to holdings in companies with operations in or supporting occupation infrastructure. These campaigns have targeted the investment portfolio dimension. No organised boycott or divestment campaign specifically targeting Aviva’s technology vendor relationships (e.g., Verint speech analytics) was identified.

Regulatory & Legal Actions

Aviva is a regulated UK insurance group under FCA and PRA oversight. No regulatory inquiries, legal challenges, export control actions, or sanctions-related investigations involving Aviva’s technology sales or services to Israeli state entities were identified. Aviva is a technology buyer and user, not a vendor or exporter; export control frameworks do not apply to its technology procurement posture in the same way they apply to technology companies. No public evidence identified of regulatory action relevant to this audit’s scope.

FCA Consumer Duty & Verint Deployment

The Verint speech analytics deployment is explicitly framed by Aviva and Verint as a Consumer Duty compliance mechanism ¹². The FCA’s Consumer Duty (effective July 2023) requires firms to demonstrate active identification and support of vulnerable customers. Aviva’s use of Verint to automate vulnerable-customer identification and create watchlists ² is consistent with this regulatory requirement. No FCA investigation or challenge regarding this specific deployment was identified.