Quick answer
Regtech (regulatory technology) means using new technology to help regulated financial firms meet their regulatory and reporting requirements, for example identity checks, money-laundering monitoring and regulatory reports. When supervisors use similar tools for their own work, it is called suptech[1].
Key points
- Regtech is technology that helps regulated firms comply with rules and report to regulators; suptech is technology used by the supervisors themselves.
- The UK's Financial Conduct Authority was talking about regtech as early as November 2015.
- Common uses include fraud detection, AML and KYC checks, identity verification, risk management and regulatory reporting.
- Regtech can make compliance faster, but responsibility stays with the firm, and tools trained on past data can miss new risks.
- Regulators are also adopting technology: a BIS study of 39 authorities found fewer than one-third of their suptech projects were operational.
On this page
#What does 'regtech' mean?
Regtech is short for regulatory technology. The Financial Stability Board (FSB) defines it as the application of financial technology for regulatory and compliance requirements and reporting by regulated institutions[1]. The short glossary entry on regtech gives the one-line version.
The word is not new. In November 2015 the UK's Financial Conduct Authority (FCA) launched a call for input on supporting the development and adoption of RegTech, which it described as new technologies that facilitate the delivery of regulatory requirements[2]. The FCA linked the interest to the heavier reporting requirements and higher regulatory standards that followed the financial crisis[2].
#How is regtech different from suptech?
They are two sides of the same coin. Suptech (supervisory technology) is the use of innovative technology by supervisory agencies to support supervision, in the definition used by the BIS Financial Stability Institute[3]. The FSB describes suptech as applications of fintech used by authorities for regulatory, supervisory and oversight purposes[1]. In short: regtech helps the firm comply; suptech helps the regulator check.
| Aspect | Regtech | Suptech |
|---|---|---|
| Who uses it | Regulated firms: banks, payment firms, insurers, fintechs[1] | Supervisors and other financial authorities[3] |
| Main goal | Meet rules and reporting duties more efficiently | Improve oversight, surveillance and analysis[1] |
| Typical examples | Identity checks, transaction monitoring, sanctions screening, regulatory reports | Data collection and analysis of the reports firms send |
| Example of the risk | A tool that misses a new fraud pattern | Decisions based on poor-quality data |
Examples simplified for beginners; both sides face data-quality and transparency challenges[1].
#What do firms actually use regtech for?
The FSB's survey found that regulated institutions mainly use regtech for fraud detection, reporting, risk management and anti-money laundering and countering terrorist financing (AML/CFT), with an upward trend in know-your-customer (KYC) and identity verification[1]. Each of these has its own guide on Tokenova:
- Identity checks: confirming that a new customer is a real, verified person; see KYC explained.
- Transaction monitoring: spotting patterns that might indicate money laundering; see anti-money laundering explained.
- Name screening: checking customers and payments against government lists; see sanctions screening explained.
- Operational resilience: mapping technology suppliers and reporting incidents; see DORA explained.
- Regulatory reporting: turning internal data into the reports supervisors require.
How a typical regtech monitoring tool works
- Data in — customers and payments
- Rules / models — thresholds, patterns, lists
- Alerts — unusual items flagged
- Human review — analyst decides
- Action — clear, escalate or report
#Why did regtech grow so fast?
Two forces met. On the demand side, firms faced more rules and more reporting after the 2008 financial crisis, as the FCA noted in 2015[2]. On the supply side, the FSB points to technology advances: a large increase in available data, cloud computing and application programming interfaces (APIs)[1]. APIs, the software connections that let systems talk to each other, are explained in how banking APIs work.
Worked example
Illustration: why automation matters for alert review
These figures are invented to show the arithmetic, not results from any real tool, and no product is guaranteed to achieve them. Suppose a firm's monitoring raises 200 alerts a day and each takes an analyst 15 minutes to review. Computed with code:
- 200 alerts × 15 minutes
- 50 analyst hours per day
- If better matching halved the alerts to 100
- 25 analyst hours per day
- Time freed for genuinely risky cases
- 25 hours per day
#What are the risks of relying on regtech?
Technology can fail like any other control. The FSB notes that growing reliance on regtech can raise operational and cyber risk, requires new models to stay intelligible and can perpetuate biases present in historical data; for supervisors' own tools it flags over-reliance on methods built on historic data and limited transparency or 'explainability'[1]. A model trained on yesterday's fraud may not recognise tomorrow's, and a 'black box' that cannot explain why it flagged a customer is hard to defend to a regulator.
#How are regulators using technology themselves?
Supervisors are moving more slowly. A 2019 BIS study of 39 financial authorities found that almost half had or were developing an explicit suptech strategy, but fewer than one-third of the suptech initiatives reported were operational; most were still experimental or in development[3]. The FSB notes that the majority of authorities it surveyed had a suptech, innovation or data strategy, and that such strategies had grown significantly since 2016[1].
Common beginner mistakes about regtech
Treating regtech as one product
It is a label for many tools: identity checks, monitoring, screening, reporting and more.
Confusing regtech with suptech
Regtech is used by regulated firms; suptech is used by supervisors.
Believing software removes the need for compliance staff
Tools sort and flag; people still review alerts and remain accountable.
Assuming more alerts means better control
Too many false alerts bury the real ones; quality of matching matters more than volume.
#Where should a beginner go next?
Start with KYC explained, because identity checks are the most visible regtech use for customers. Then read anti-money laundering explained to see what monitoring is looking for, and regulatory sandboxes explained to see how regulators test new ideas.
The bottom line
Regtech is technology that helps financial firms meet their rules, from identity checks to regulatory reports, while suptech is the same idea on the regulator's side. It grew because rules multiplied and data, cloud computing and APIs made automation possible. It speeds up compliance, but firms stay responsible, and tools built on past data need people watching for what is new.
Frequently asked questions
Is regtech a type of fintech?
Yes, in the sense that it applies financial technology to a specific job: the FSB defines regtech as the application of fintech for regulatory and compliance requirements and reporting by regulated institutions[1].
Who uses suptech?
Financial supervisors and other authorities, to support their own oversight work[3].
Does regtech replace compliance officers?
No. Tools flag and sort, but people review alerts, make decisions and remain responsible, and the FSB notes that relying on regtech can perpetuate biases present in historical data[1].
When did people start talking about regtech?
The term was in regulatory use by November 2015, when the UK's FCA published a call for input on supporting RegTech[2].
Sources
- The Use of Supervisory and Regulatory Technology by Authorities and Regulated Institutions: Market developments and financial stability implications — Financial Stability Board, 2020 Primary
- Call for Input: Supporting the development and adoption of RegTech — Financial Conduct Authority, 2015 Primary
- The suptech generations (FSI Insights No 19) — executive summary — Bank for International Settlements, Financial Stability Institute, 2019 Primary
- A Framework for OFAC Compliance Commitments — Office of Foreign Assets Control, US Department of the Treasury, 2019 Primary
