RegTech (Regulatory Technology) is software that automates work regulated firms must do to comply with the law: onboarding checks, transaction monitoring, sanctions screening, regulatory reporting and the evidence trail proving each was done. Banks, payment institutions, EMIs, crypto-asset service providers and investment firms buy it; compliance, risk and finance teams use it daily. Identity tools match document scans to selfies and liveness tests, screening engines check customers against sanctions and PEP lists, and monitoring systems flag patterns such as structuring. Tuning rules cuts false-positive alerts and analyst headcount, but missed true positives become supervisory findings. Under DORA each RegTech contract enters the register of information, and the licensed firm stays accountable for what the tool misses.
RegTech examples by function
Identity verification tools run know-your-customer checks by matching a document scan against a selfie and a liveness test. Sanctions screening engines compare customers and payment counterparties against sanctions and politically exposed person lists, both at onboarding and each time the lists change. Transaction monitoring systems apply rules and models to flag patterns such as structuring below reporting thresholds or funds passing straight through an account. Reporting tools map ledger data to regulator templates. Case-management layers record who reviewed each alert and why it was closed, which is what auditors and supervisors ask to see.
How RegTech changes compliance costs
Illustrative: a payment institution with 50,000 customers generates 3,000 monitoring alerts a month, of which 95% are false positives and 150 are genuine. An analyst clearing 15 alerts a day over 20 working days handles 300 a month, so the firm needs 10 analysts. Tuning the rules so that 85% of alerts are false positives while still catching all 150 genuine cases cuts volume to about 1,000 alerts, which four analysts can clear.
The risk runs the other way as well. A model tuned to cut alerts that also starts missing true positives becomes a finding in the next supervisory review, so tuning changes need documented testing on historical cases before they go live.
RegTech under DORA and outsourcing rules
Since 17 January 2025, the Digital Operational Resilience Act has required EU financial entities to record every ICT service contract, RegTech included, in a register of information, and to keep exit plans for providers that support critical or important functions. A KYC or monitoring vendor usually supports such a function. Outsourcing does not move responsibility: the licensed firm remains accountable for what the tool decides or misses.
What changes from 2027
The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, applies from 10 July 2027 and replaces national transpositions with a single rulebook on customer due diligence, beneficial ownership and record-keeping. The new Anti-Money Laundering Authority (AMLA) will begin directly supervising up to 40 selected high-risk, cross-border obliged entities in 2028. RegTech rule sets built around national requirements will need re-mapping before July 2027.
For a buyer of a licensed fintech, the RegTech stack is both an asset and a dependency: diligence should cover whether vendor contracts survive a change of control, the size of any alert backlog, validation of monitoring models, and whether historical KYC data can be exported if the vendor is replaced.