RegTech
Also called regulatory technology, regtech
RegTech, short for regulatory technology, is software that helps regulated firms meet their legal and regulatory obligations. It covers areas such as identity checks, transaction monitoring, sanctions screening, regulatory reporting, risk management and regulatory change tracking. Firms use it to automate manual compliance work, improve data quality and evidence controls to supervisors.
How it works
Banks, insurers, asset managers and payment firms buy RegTech to replace spreadsheets and manual checks. A typical stack includes onboarding and KYC tools, screening and monitoring engines, case management, reporting software and governance, risk and compliance platforms. Many products use machine learning or language models. The UK FCA brought the term into wide use with a 2015 call for input on supporting RegTech.
Buying RegTech does not transfer responsibility. Firms remain accountable for compliance outcomes and must oversee suppliers. In the EU, DORA treats RegTech vendors as ICT third-party service providers subject to contract and oversight requirements. In the UK, the PRA's outsourcing statement SS2/21 sets similar expectations. Supervisors' own use of technology is called SupTech.
The rules
Requires ICT risk management, incident reporting, resilience testing and contractual controls over ICT third-party providers, including software suppliers.
EU financial entities and their ICT third-party service providersSets expectations for due diligence, contracts, data security, oversight and exit plans when firms outsource or rely on third parties.
PRA-regulated banks, building societies and insurersCommon questions
What is the difference between RegTech and SupTech?
RegTech is technology regulated firms use to meet their obligations. SupTech is technology supervisors and regulators use to collect data, analyse risk and oversee firms.
What are the main types of RegTech?
Main categories include identity verification and KYC, transaction monitoring, sanctions and name screening, regulatory reporting, communications and trade surveillance, regulatory change management, and governance, risk and compliance platforms.
Are RegTech vendors regulated?
Most are not authorised firms. Their clients are, and rules such as DORA in the EU and PRA outsourcing expectations in the UK require firms to manage and contract for the risks of using them.
