What is regtech?

In banking, regtech means software for tasks that the law requires. The meaning comes from the EBA definition: "any range of applications of technology-enabled innovation for regulatory, compliance and reporting requirements implemented by a regulated institution (with or without the assistance of RegTech provider)".

Across the banking industry, many of those tasks are legal duties with a technical core. Section 25h(2) of the German Kreditwesengesetz requires credit institutions to operate data processing systems that detect business relationships and payments which are unusually complex or large, or which have no apparent economic or lawful purpose. A bank can build such a system or buy it. Either way, the system is regtech.

Regtech solutions are used most for anti-money laundering. For regtech in Europe, the main data source is the EBA survey. Of the banks in the EBA survey of spring 2021 that used RegTech, 80% had solutions for AML/CFT, 55% for fraud prevention, 36% for prudential reporting, 25% for creditworthiness assessment and 23% for ICT security.

Regtech examples from these segments are customer screening against sanctions lists, transaction monitoring, the automated build of regulatory reports and credit checks. Regtech AI tools learn patterns from data, for example to flag unusual payments. Banks named "better monitoring and sampling capabilities, and reduced human error" as main benefits. On regtech compliance risks, the EBA warns that tools which are not properly implemented can create compliance, concentration and ICT risks, and that supervisors may lack the skills to audit the algorithms.

Suptech is technology that authorities use for regulation, supervision and oversight. The Financial Stability Board describes RegTech as FinTech "for regulatory and compliance requirements and reporting by regulated institutions" and SupTech as FinTech "used by authorities for regulatory, supervisory and oversight purposes" (FSB, October 9, 2020).

The BIS Financial Stability Institute found suptech applications in two areas, data collection and data analytics (FSI Insights No 9, July 16, 2018). In the FSB survey, regulatory reporting and data management were the most common suptech use cases, and artificial intelligence applications were the most commonly deployed suptech tool.

Regtech and suptech differ in who uses the tool. A regulatory report can pass through both: the bank builds it with regtech, and the supervisor analyzes it with suptech.

A regtech company is a provider that sells such tools to regulated firms. The FSB counts regtech as one part of fintech, so what is regtech in fintech has a short answer: fintech applied to compliance. That is also the difference in regtech vs fintech: fintech covers any technology-enabled innovation in financial services, regtech only the part that serves regulatory and compliance duties. Examples of regtech companies are vendors of sanctions screening, transaction monitoring or regulatory reporting software.

A bank in the EU that buys a regtech tool buys an ICT service. Under Article 28(3) of the Digital Operational Resilience Act (DORA), it must keep a register of information on all contracts for ICT services from third-party providers. The bank stays responsible for its compliance even when a provider runs the tool (Article 28(1)).

For regtech in Germany, the law sets the monitoring duty without prescribing a tool. Section 25h(2) KWG requires the monitoring systems, and BaFin may set criteria under which a credit institution does without them. For regtech, Frankfurt is the seat of the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA). AMLA started operations in summer 2025, selects 40 obliged entities for direct supervision during 2027 and starts that supervision in 2028. Austrian law names the technology: § 7a of the Finanzmarkt-Geldwäschegesetz allows transaction monitoring "unter Verwendung eines auf künstlicher Intelligenz oder anderen fortschrittlichen Technologien basierenden Ansatzes" if the conditions of paragraph 2 are met. The FMA supervises compliance (§ 25).

In Switzerland, FINMA Guidance 08/2024 of December 18, 2024 covers governance and risk management when institutions use artificial intelligence (AI). It names model risks such as a lack of robustness, correctness, explainability or bias. This page gives no legal advice.