---
title: "RegTech"
url: "https://mahouse.world/glossary/regtech"
type: "glossary term"
topic: "Financial crime"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-06"
---

# RegTech

RegTech — regulatory technology — is software and data services that help regulated firms meet their obligations more accurately and at lower cost: identity verification and KYC, sanctions and PEP screening, transaction monitoring, regulatory reporting, trade surveillance, record-keeping, policy management, and the horizon-scanning that tracks rule changes. It is the compliance function's supply chain, a sector of its own, and one of the most active corners of fintech M&A, because compliance spend is non-discretionary and the products are sticky.

**Also known as:** Regulatory technology, Compliance technology, Regtech

## Key facts

- **Used at:** every regulated financial firm's compliance, financial-crime, risk and finance functions; also, in a wider sense, by regulators themselves (SupTech) to process the data firms report
- **Binding:** the vendors are not regulated, but the firm that uses them remains fully responsible — outsourcing rules (EBA guidelines, the UK's SYSC 8, US third-party risk guidance, the EU's DORA for ICT providers from 2025) require oversight, exit plans and, for critical services, contractual rights the vendor must accept; a model bought from a vendor is still the firm's model under model-risk rules and the EU AI Act
- **Typical segments:** identity and KYC (Onfido, Jumio, Sumsub, Veriff); screening and monitoring (ComplyAdvantage, Napier, Hawk, Quantexa, NICE Actimize, Feedzai on the fraud border); regulatory reporting (Wolters Kluwer, AxiomSL); surveillance (Nasdaq, SteelEye); the data providers (LexisNexis, Refinitiv/LSEG, Moody's) that own the lists everything screens against
- **Typical economics:** subscription and per-check pricing; gross margins of 60–80% for software, lower for services; net revenue retention above 110% for the strong vendors, since customers add checks as they grow; valuations at software multiples with a premium for regulatory stickiness
- **Typical M&A:** data giants buying identity and screening vendors (LSEG–GIACT, Moody's–RDC, LexisNexis–IDVerse), private equity consolidating mid-market compliance software, fintechs buying the RegTech they had rented, and, since 2023, buyers paying for AI-native monitoring that cuts false positives
- **Parties:** the vendors, the regulated firms, their regulators (who assess the firm's use of the vendor), the data providers upstream, and the acquirers

## How RegTech works in practice

A payment institution's compliance stack is a chain of vendors. Onboarding: an identity-verification API checks documents and faces; a screening API checks names against sanctions and PEP lists updated daily from several data providers; a KYB service resolves company ownership from registers. Operations: a transaction-monitoring platform runs rules and models over every payment and produces alerts into a case-management system where analysts work them; a screening service re-checks the customer base against list updates every night; a reporting tool assembles the regulator's periodic returns from the ledger. Governance: a policy-management system holds the procedures, a training platform records who read them, and a horizon-scanning feed flags the rule changes that will require the next round of work. Each vendor is under an outsourcing agreement with audit rights, service levels and an exit plan, because the regulator will ask.

The direction of the sector is from rules to models and from point tools to platforms. Rules-based monitoring generates false-positive rates above 90%; vendors that cut them with machine learning, network analysis and better data sell on analyst hours saved and cases found — with the burden of explaining a model's alerts to a regulator who expects a reason. Platforms that combine onboarding, screening and monitoring with one customer view compete against best-of-breed stacks. And the buyers of RegTech companies price the stickiness: a screening vendor embedded in a bank's onboarding is replaced only at great cost, so its revenue is close to annuity, and the acquisition multiples reflect it. For a fintech, RegTech is how a compliance function of twenty does the work that took two hundred; the residual risk is that the vendor's failure — an outage, a missed list update, a model that drifted — is the firm's failure in the regulator's eyes.

For a fintech buyer, RegTech is a spend line to consolidate and a diligence item on the target's vendor contracts; for a RegTech founder, the exit is a data company, a platform or a sponsor, and the price is the retention.

## Example

A screening and monitoring vendor with €28 million of recurring revenue, growing 35%, net revenue retention of 118%, 260 customers of which 40 are banks, and a machine-learning alert-prioritisation model that cuts customers' false positives by half runs a sale in 2025. Bidders: a financial-data group wanting the customer base for its lists (offers 10× revenue, €280 million), a private-equity firm building a compliance platform (9×), and a large payments company that is a customer (8×, with a plan to take the product in-house). Diligence spends its longest week on the model: its documentation, its performance by customer, the explanations it gives analysts, and its EU AI Act classification. The data group wins at €290 million; the vendor's founders had built the list-matching engine and the customer relationships over nine years, and the model over the last two.

## Common mistakes

- Treating a vendor's model as the vendor's responsibility; under model-risk and outsourcing rules it is the firm's.
- No exit plan for a critical vendor, and a contract without the audit rights the regulator expects.
- Buying point tools without a customer view that connects them.
- Paying for a machine-learning monitor and running it on the old rules' thresholds.
- Valuing a RegTech target on growth alone; retention is the asset.

## Related terms

- [AML](https://mahouse.world/glossary/aml.md)
- [KYC](https://mahouse.world/glossary/kyc.md)
- [Transaction Monitoring](https://mahouse.world/glossary/transaction-monitoring.md)
- [Sanctions Screening](https://mahouse.world/glossary/sanctions-screening.md)
- [MLOps](https://mahouse.world/glossary/mlops.md)
- [Explainable AI](https://mahouse.world/glossary/explainable-ai.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov