RegTech

RegTech, short for regulatory technology, is software and data technology that helps regulated firms meet their legal and regulatory obligations. Banks, payment companies, money transmitters, insurers, investment firms and crypto businesses use it to verify customers, monitor transactions, screen names against sanctions lists, manage policies and produce reports for supervisors. The aim is to make regulatory compliance faster, cheaper, more consistent and easier to evidence.

RegTech is usually treated as a branch of fintech. Its counterpart on the supervisor's side is SupTech, the technology that regulators themselves use. The word became common in the UK in 2015, when HM Treasury asked the Financial Conduct Authority (FCA) to support technologies that help firms handle regulatory requirements; the FCA issued a call for input that November and published its feedback in July 2016.

Think of a busy restaurant kitchen that must follow food-safety rules. It could rely on a chef with a clipboard checking fridge temperatures by hand, or it could fit sensors that log the temperature every minute and send an alert if a fridge warms up. The rules are the same; the second way is faster, misses less and leaves a clear record for the inspector.

RegTech is the sensor-and-logbook approach for financial rules. Instead of staff checking every customer and payment by hand, software does the routine checks, flags the unusual cases for a person to review, and keeps a trail showing what was checked and when.

RegTech covers most of the work a compliance department does. The main categories are:

• Onboarding and identity. Tools for identity verification (IDV), document and liveness checks, know your customer (KYC) and know your business (KYB) checks, and ongoing customer due diligence.
• Monitoring. Transaction monitoring systems that apply rules, anomaly detection and behavioral analytics to spot possible money laundering or fraud, and blockchain analytics for crypto flows.
• Screening. Sanctions screening of customers and payments against each sanctions list, plus politically exposed person and adverse media checks.
• Reporting. Tools that gather data and produce regulatory reporting returns, transaction reports and suspicious activity filings.
• Governance. Platforms for policies, risk registers, regulatory change tracking ("horizon scanning"), compliance testing and case management, often packaged as a compliance management system.

The growth of RegTech followed the surge in rules after the 2008 financial crisis and the rising cost of financial-crime controls. Several pressures push firms towards automation:

• Volume. A payment company handling millions of transactions a day cannot review them manually; it needs automated rules and scoring to pick the few that need a human.
• Speed. Instant payment schemes and digital onboarding leave seconds, not days, for checks.
• Evidence. Supervisors expect firms to show what they checked and why. Software keeps audit trails that support an AML audit or an inspection.
• Consistency. Automated checks apply the same standard to every case, while still leaving judgement to analysts.

Most firms buy RegTech from specialist vendors rather than build it, which creates its own obligations. Supervisors are clear that outsourcing a control does not outsource the responsibility: the firm remains accountable for the outcome. That brings RegTech within third-party risk and vendor risk management, and typical expectations include:

• Tuning and testing. Screening and monitoring thresholds must be calibrated to the firm's own risk assessment, then tested; untuned systems either miss real cases or swamp analysts with false alerts.
• Model governance. Where tools use machine learning, firms must be able to explain why a customer or payment was flagged and show that the model does not discriminate unfairly.
• Data quality. A tool is only as good as the data fed into it; incomplete customer records undermine every downstream check.
• Oversight. A named senior person, often the chief compliance officer (CCO), owns the system's performance and reports on it to the board.

Regulators encourage experimentation through innovation hubs and the regulatory sandbox model, which the FCA introduced in 2016 and many authorities have since copied.

RegTech does not remove the need for compliance staff or sound judgement. Known weaknesses include high false-positive rates in screening and monitoring, tools adopted as a box-ticking exercise without proper calibration, concentration of the market in a few large vendors, and the risk that firms trust an opaque model they do not understand. Data protection law, such as the General Data Protection Regulation (GDPR), also limits how customer data can be shared with vendors and used for automated decisions. Used well, RegTech supports a risk-based approach; used badly, it creates a false sense of security.

• Financial Conduct Authority: RegTech