Regulatory technology is how banks, fintechs and listed companies meet their rules at scale. This guide explains each category, what it does, who leads it and which rules are driving demand.
Updated November 2026
Regulatory technology at a glance
| Category | What it does | Rules driving demand |
|---|---|---|
| AML and sanctions screening | Screens customers and payments, monitors transactions for laundering | EU AML package and AMLA · Bank Secrecy Act · UK Money Laundering Regulations |
| Identity verification, KYC and KYB | Confirms people and companies are who they say they are | Customer due diligence rules · Companies House ID checks |
| Fraud prevention | Scores payments, devices and identities in real time | UK failure to prevent fraud offense |
| GRC and audit | Holds risks, controls, policies and audit evidence in one system | Sarbanes-Oxley · internal control frameworks |
| Regulatory change and reporting | Tracks new rules and files the returns regulators require | MiFID II · UK transaction reporting regime (2028) |
| Trade and communications surveillance | Monitors trades and staff communications for market abuse | Market abuse rules · SEC Rule 17a-4 |
| Privacy and cybersecurity | Maps personal data and proves security controls | GDPR · NIS2 · SOC 2 · ISO 27001 |
| Resilience and third-party risk | Tests critical services and assesses suppliers | DORA · UK operational resilience rules |
| AI governance | Inventories, tests and controls AI models and agents | EU AI Act · FCA expectations on AI |
| Crypto compliance | Traces blockchain funds and handles the travel rule | MiCA · travel rule |
| ESG and supply chain | Collects sustainability data and checks suppliers | CSRD |
What is regulatory technology, exactly?
Regulatory technology is the software that banks, payment firms, asset managers and listed companies use to meet their regulatory obligations: checking customers, monitoring transactions, filing reports and proving that controls work. It replaces work that compliance teams once did by hand, in spreadsheets and in email.
The term covers a wide range. A two-person crypto exchange screening wallets against sanctions lists uses regulatory technology. So does a global bank that runs tens of millions of trades a day through automated rule checks before they execute.
For a compliance officer or CFO the useful question is narrower: which category of regulatory technology solves which problem, and which companies lead it. This guide answers that, category by category.
Three forces shape every category in 2026. Europe is rebuilding its anti-money laundering regime around a new central authority. Rules on operational resilience and AI have moved from consultation to supervision. And AI agents are starting to do the review work that compliance analysts used to do line by line.
AML and sanctions screening: the regulatory technology core
Key rulesEU AML package and AMLA · Bank Secrecy Act · UK Money Laundering Regulations
Anti-money laundering software screens customers and payments against sanctions lists, politically exposed persons and adverse media, then monitors account activity for patterns that suggest laundering. Transaction monitoring is the heart of it: rules and models that flag unusual payments for an analyst to review.
Read more: AMLA 2026: EU Anti-Money Laundering Authority rules, timeline, and impact
This is the largest and most crowded part of the market. NICE Actimize, LexisNexis Risk Solutions, ComplyAdvantage and Quantexa serve the biggest banks. A newer group built around machine learning is winning large contracts: Commerzbank adopted Hawk AI in 2026 to modernize how it detects and investigates money laundering.
Investment has followed. Quantifind raised $200 million in 2026 to take its financial crime platform into Europe, Asia Pacific and the Americas. Napier AI raised $57 million, Flagright closed a $12.5 million Series A, and in October 2026 Hummingbird acquired Quantimon to add machine learning to its platform.
The rules are changing as fast as the software. The EU’s Anti-Money Laundering Authority, based in Frankfurt, plans to be fully operational by 2028, with a single rulebook replacing national regimes. Firms buying screening and monitoring tools now are buying for that regime.
Identity verification, KYC and KYB
Key rulesCustomer due diligence rules · Companies House ID checks
Know your customer software confirms that a person is who they say they are, usually by matching an identity document to a live selfie and screening the result. Know your business software does the same for companies, tracing directors and beneficial owners through company registries.
Read more: Navigating global KYC requirements using tech
The category consolidated early. Entrust paid $650 million for Onfido in April 2024. Sumsub, Jumio, Veriff and Socure compete for the largest platforms, while ComplyCube, AiPrise and Sinpex focus on faster-growing fintechs and mid-sized firms. MoneyGram picked AiPrise for its global verification workflows in October 2026.
Reusable identity is the next step. In October 2026 Sumsub launched a reusable KYC gateway that lets users of the MiniPay wallet verify once and reuse that check with the wallet’s regulated partners.
Rules are moving in different directions. Companies House made identity checks mandatory for UK company directors in November 2025. In the US, FinCEN removed beneficial ownership reporting for domestic companies in August 2026.
Fraud prevention technology
Key rulesUK failure to prevent fraud offense
Fraud prevention software scores transactions, devices and identities in real time to stop a payment before money leaves the account. It overlaps with AML but asks a different question: is this customer about to lose money, rather than is this money dirty.
Read more: Banks turn to AI agents for AML, fraud detection and risk monitoring
Generative AI has changed the threat. Forged documents, synthetic identities and deepfake selfies are now cheap to produce at scale, and detection has had to move from checking a document to checking how it was made. Resistant AI raised a $25 million Series B to detect document fraud and monitor transactions.
Identity risk is the other growth area. Monnai raised $12 million in 2026 for a real-time identity risk platform, bringing its total funding to $23 million. Forter, Feedzai and Sardine sell to merchants and banks that want fraud decisions made in milliseconds.
In the UK, the failure to prevent fraud offense now puts the burden on large companies to show they had reasonable procedures in place, which has pushed fraud controls onto the board agenda.
GRC platforms and audit technology
Key rulesSarbanes-Oxley · internal control frameworks
Governance, risk and compliance platforms hold a company’s risk register, control library, policies and audit evidence in one system. They replace the spreadsheets and shared drives that many compliance programs still run on.
Read more: The future of GRC platforms: AI, automation and risk prediction
AuditBoard, ServiceNow, MetricStream, Archer and LogicGate lead the enterprise market. Onspring and a wave of AI-native startups compete for mid-sized firms that want a platform running in weeks rather than months.
Sarbanes-Oxley testing is the fastest-moving corner. Petual raised $20 million in 2026 to automate SOX control testing with AI agents, and IntelliGRC raised $3.5 million to scale its compliance platform.
The pitch is the same across the category: collect evidence once, map it to many frameworks, and give auditors and regulators a single record of what was tested and when.
Regulatory change management and reporting
Key rulesMiFID II · UK transaction reporting regime (2028)
Regulatory change management software reads new rules, consultations and enforcement notices, maps them to a firm’s obligations and tells each team what has to change. Regulatory reporting software then produces the returns that regulators require, from capital reports to trade-by-trade transaction reports.
Read more: Preparing for FCA transaction reporting changes by April 2028
This is where AI has had the most visible effect on regulatory technology. CUBE, Corlytics and Norm AI all use language models to turn rule text into machine-readable obligations. CUBE acquired 4CRisk.ai in February 2026, and Wilmington bought Spain’s Conversia for €121.6 million.
On the reporting side, Wolters Kluwer’s OneSumX, Suade Labs and Droit are established names. Droit checks orders against regulatory rules before they execute and processes tens of millions of queries a day for large banks.
Deadlines keep the category busy. In the UK a new transaction reporting regime takes effect on April 3, 2028, and the FCA consulted on the transitional rules in October 2026.
Trade and communications surveillance
Key rulesMarket abuse rules · SEC Rule 17a-4
Trade surveillance software monitors orders and trades for insider dealing and market manipulation. Communications surveillance captures and reviews email, chat and voice so a firm can show regulators what its traders said and when.
Read more: MiFID II overview: key rules and the digital tools driving compliance
In October 2026 SteelEye and FundApps merged to form RegSensus, combining trade and communications surveillance with shareholding disclosure monitoring for investment managers. Global Relay expanded its archiving to cover Gmail, Google Chat, Meet and Drive for firms with record-keeping duties such as SEC Rule 17a-4.
NICE Actimize, Behavox, Smarsh and Shield are other established providers. StarCompliance, which serves more than 500 clients on employee trading and conflicts, added a natural-language AI agent to its analytics in October 2026.
Data privacy and cybersecurity compliance
Key rulesGDPR · NIS2 · SOC 2 · ISO 27001
Privacy software maps where personal data lives, manages consent and handles access requests under GDPR and US state privacy laws. Cybersecurity compliance software collects the evidence companies need for SOC 2, ISO 27001 and the EU’s NIS2 rules.
Read more: GDPR tech stack: tools powering privacy in the corporate world
OneTrust and Osano lead privacy management. Feroot Security raised a $14 million Series A in November 2025 to automate privacy compliance.
Security compliance is one of the busiest areas for startups. Vanta, Drata and Secureframe built the category in the US. In Europe, Amsterdam’s Oneleet raised a $33 million Series A, Munich’s Secfix raised $12 million and Lithuania’s Copla raised €6 million, each automating security compliance for growing companies.
NIS2, which came into effect in October 2024, widened the number of European companies that must prove their security controls, and that has pushed demand well beyond financial services.
Operational resilience and third-party risk
Key rulesDORA · UK operational resilience rules
Operational resilience software maps a firm’s important business services, tests how they fail and records incidents. Third-party risk management software assesses suppliers, from cloud providers to outsourced call centers, and tracks them over the life of each contract.
Read more: DORA: a complete overview of Europe's Digital Operational Resilience Act
In Europe both categories are now driven by DORA, which became fully applicable on January 17, 2025. It requires financial firms to manage ICT risk, report major incidents and keep a register of their technology suppliers.
Supervisors are checking. In October 2026 Vixio warned that firms still running DORA on spreadsheets and email chains risk falling short as national regulators step up scrutiny. EU supervisors have also named 19 critical technology providers for direct oversight.
Archer, ProcessUnity, Prevalent and Panorays are among the third-party risk platforms, while Noggin focuses on resilience and critical event management.
AI governance and regulatory technology
Key rulesEU AI Act · FCA expectations on AI
AI governance software inventories the models and AI agents a company uses, tests them for errors and bias, and records the controls regulators expect. Model risk management in banks is the oldest version of the discipline.
Read more: EU AI Act: a global benchmark for governing artificial intelligence
Adoption has run ahead of governance. In October 2026 the Bank of England and the FCA said 86% of UK financial firms in their survey use AI and that generative AI now makes up 56% of the AI systems firms report, up from 17% for foundation models in 2024.
Regulators are setting expectations. The EU AI Act entered into force in August 2024 and is being phased in. In October 2026 the FCA published examples of good and poor practice in firms’ use of AI and said firms remain responsible for AI services they buy from third parties.
AI agents have created a new category. Opsin raised $21 million and Cygrid raised €2.66 million in October 2026 to control what AI agents can see and do inside a company.
Crypto compliance
Key rulesMiCA · travel rule
Crypto compliance software traces funds across public blockchains, screens wallet addresses against sanctions lists and handles the travel rule, which requires sender and recipient details to move with transfers between exchanges and wallet providers.
Read more: Markets in Crypto-Assets Regulation (MiCA) explained
Chainalysis, Elliptic and TRM Labs dominate blockchain analytics, and Notabene is one of the best-known travel rule networks. The same tools are now used by banks that hold or process digital assets, not only by exchanges.
Regulation has brought crypto firms into the same regime as everyone else. The EU’s MiCA rules now license crypto firms across the bloc. In the UK, the FCA chose Eunice AI to trial standardized disclosure templates for crypto assets in its regulatory sandbox, built with Coinbase, Crypto.com and Kraken.
ESG and supply chain compliance
Key rulesCSRD
ESG compliance software collects emissions, labor and supplier data and turns it into the disclosures that rules such as the EU’s Corporate Sustainability Reporting Directive require. Supply chain tools check suppliers for forced labor, deforestation and sanctions risk.
Read more: EU ESG reporting: inside the Corporate Sustainability Reporting Directive
The category sits where compliance meets procurement. Large customers now ask their suppliers to prove their sustainability claims, and software is how those suppliers collect and share the evidence. More than 500 enterprises use Sunhat’s platform to turn their evidence into verified proof for EcoVadis, CDP and CSRD.
Consolidation has started here too. Osapiens, the Mannheim-based sustainability software company, acquired Berlin’s Lucent AI in December 2025 to bring risk management and compliance automation into its platform. Non-EU companies with more than €150 million of EU turnover face CSRD reporting from financial year 2028, which will widen the market again.
Who makes regulatory technology
Behind every category above are decades-old incumbents and AI-native startups. RegTech Post’s regtech directory lists nearly 1,000 regulatory technology companies across 15 categories, from AML screening to ESG reporting, and the glossary explains nearly 400 of the terms used in this guide.
How to evaluate regulatory technology
With the categories mapped, the harder question is how a compliance officer or CFO should choose. A few criteria matter more than the rest.
Start with the rule. Write down which regulation the tool must satisfy, which regulator will review it and what evidence they will ask for. A product that cannot produce that evidence is not compliance software, whatever the demo shows.
Test it on your own data. Screening and monitoring tools live or die on false positives. Run a sample of real customers and payments through the system before signing.
Ask how the AI decides. Regulators expect firms to explain automated decisions. The vendor must show why an alert fired, why it did not, and who can change the threshold.
Check where the data sits. Hosting, data residency and the vendor’s own suppliers all fall under DORA and similar third-party rules, so the vendor becomes part of your supply chain.
Count the total cost. Implementation, data feeds, list subscriptions and analyst time often cost more than the license.
Plan the exit. Make sure case history, audit trails and evidence can be exported if you change provider, because regulators will still ask for them.
Common questions about regulatory technology
What is the difference between regtech and fintech?
Fintech is technology that delivers financial services, such as payments or lending. Regulatory technology helps any regulated company comply with the rules, and its biggest customers are often fintechs themselves.
Is regulatory technology only for banks?
No. Banks and payment firms are the largest buyers, but asset managers, crypto firms, insurers, listed companies and any business that handles personal data now use regulatory technology.
How is AI used in regulatory technology?
AI reads new rules and maps them to obligations, cuts false positives in screening and monitoring, and increasingly clears routine alerts on its own. Regulators expect firms to explain and control those decisions.
What is the difference between regtech and suptech?
Regtech is used by regulated firms to comply. Suptech, or supervisory technology, is used by regulators themselves to collect data and supervise the firms they oversee.
Which rules are driving regtech demand in 2026?
In Europe, the new AML authority, DORA and the EU AI Act. In the UK, the failure to prevent fraud offense and the new transaction reporting regime. In the US, Sarbanes-Oxley and record-keeping rules continue to drive spending.
What's next for regulatory technology
Three things will shape regulatory technology over the next two years. The EU’s AML authority will move from writing rules to supervising firms directly, which will pull European banks and fintechs onto shared standards for screening and monitoring.
AI agents will keep moving from assisting analysts to clearing alerts, testing controls and drafting reports on their own, with regulators asking firms to show who is accountable for each decision. And AI governance itself will become a standard line in compliance budgets, alongside AML, privacy and resilience.
The common thread is evidence. Regulators no longer ask only whether a firm has a policy. They ask it to prove, with records, that the policy worked, and regulatory technology is how firms produce that proof.
