RegTech — regulatory technology — refers to the use of technology solutions to address compliance obligations more efficiently, accurately and consistently than manual processes alone. For payment institutions and electronic money institutions, where compliance requirements span anti-money laundering, transaction monitoring, sanctions screening, safeguarding, regulatory reporting and consumer duty, the operational burden is substantial and growing. This article examines the practical case for RegTech adoption, key use cases, vendor assessment criteria and regulatory expectations.
What Is RegTech and Why Does It Matter?
The term RegTech encompasses a broad range of technology solutions designed to help firms meet regulatory obligations. In the context of payment institutions, the most relevant applications include: automated transaction monitoring systems that detect suspicious patterns in real-time; KYC and KYB (Know Your Customer/Know Your Business) platforms that automate identity verification, document checks and ongoing due diligence; sanctions screening tools that check customers and transactions against global sanctions lists; regulatory reporting platforms that automate the preparation and submission of FCA returns; and risk assessment tools that calculate and monitor prudential capital requirements, safeguarding obligations and concentration risk.
The FCA has been a consistent advocate for RegTech adoption. In its 2023 feedback statement on technology in financial services, the FCA stated that firms using manual processes to manage compliance functions where reliable technology alternatives exist may face supervisory questions about the adequacy of their arrangements. This is particularly relevant for transaction monitoring, where the volume and velocity of payments processed by modern PIs and EMIs exceeds what manual review can meaningfully cover.
Key Use Cases for Payment Institutions
Transaction monitoring. This is the highest-impact RegTech application for most payment institutions. Modern transaction monitoring systems use rules-based engines combined with machine learning models to identify potentially suspicious transactions in real-time or near-real-time. Effective systems reduce both false positives (which consume analyst time) and false negatives (which represent undetected financial crime). For firms processing significant volumes — particularly in cross-border remittance, merchant acquiring or e-money — automated monitoring is not merely beneficial but effectively necessary to meet FCA expectations under the MLRs 2017.
KYC and identity verification. Automated KYC platforms integrate document verification, biometric checks, PEP and sanctions screening, adverse media monitoring and electronic identity verification into a single workflow. This reduces onboarding time from days to minutes while maintaining or improving the quality of due diligence. For firms with high-volume consumer onboarding — such as prepaid card issuers or digital wallet providers — manual KYC processes create bottlenecks that damage both compliance quality and customer experience.
Sanctions screening. Real-time screening of customers, counterparties and transactions against global sanctions lists (HMT, OFAC, EU, UN) is a core obligation for all payment firms. Manual screening is impractical at scale and introduces unacceptable lag. Automated screening tools provide real-time matching with configurable fuzzy logic to manage false positives while ensuring comprehensive coverage.
Regulatory reporting. Payment institutions are required to submit various regulatory returns to the FCA, including annual financial statements, complaints data, transaction volumes and ad hoc information requests. RegTech reporting tools can automate data extraction from core systems, populate return templates and provide audit trails. This reduces the risk of manual errors that can trigger FCA queries and supervisory attention.
Safeguarding reconciliation. Under the enhanced safeguarding requirements following PS25/12, firms must maintain accurate, timely reconciliation of customer funds held in safeguarding accounts. Automated reconciliation tools can match transaction-level flows against safeguarding balances, identify discrepancies immediately and generate the records required for internal and external audit.
Vendor Assessment and Due Diligence
Selecting a RegTech vendor requires the same rigour that firms apply to any material outsourcing arrangement — and in many cases, the FCA will treat the arrangement as outsourcing of an important operational function. Key assessment criteria include: regulatory track record and references from firms of comparable size and complexity; data security and privacy compliance (UK GDPR, ISO 27001); integration capabilities with the firm's existing core banking or payment processing systems; transparency of methodology (particularly for transaction monitoring and risk scoring); configurability to the firm's specific risk profile and customer base; business continuity and disaster recovery; contractual terms including data ownership, portability and exit provisions; and ongoing support and update cadence.
Critically, firms must remember that outsourcing compliance technology does not outsource compliance accountability. The FCA holds the regulated firm — not the technology provider — responsible for the effectiveness of its compliance arrangements. If a transaction monitoring system fails to detect suspicious activity because it was poorly configured or inadequately calibrated, the firm faces regulatory action, not the vendor.
FCA Expectations and Supervisory Approach
The FCA's position on RegTech is nuanced. The regulator actively encourages adoption and has invested in innovation initiatives — including the regulatory sandbox, TechSprints and the permanent Digital Sandbox — to facilitate RegTech development and testing. However, the FCA also expects firms to exercise genuine judgment when implementing technology solutions. A firm that blindly relies on a vendor's default settings without calibrating to its own risk profile is as likely to face supervisory criticism as a firm using manual processes.
The FCA specifically expects firms to: understand how the technology works (not as a black box); maintain adequate human oversight of automated decision-making; regularly validate and test system effectiveness; retain the ability to override automated decisions where appropriate; and document the rationale for technology choices and configuration decisions. For transaction monitoring, the FCA expects firms to be able to explain their detection scenarios, threshold settings and the basis for any machine learning models deployed.
Implementation Approach
RegTech implementation should be phased rather than attempting a simultaneous overhaul of all compliance functions. The recommended approach is to identify the compliance function that presents the greatest combination of risk, operational burden and potential for technology improvement — for most payment institutions, this is transaction monitoring — and implement that first. This allows the firm to build internal expertise, establish vendor management processes and demonstrate value before expanding to additional use cases.
A typical implementation timeline for a mid-size payment institution is: 4–8 weeks for vendor selection and contracting; 4–12 weeks for integration, configuration and testing; 2–4 weeks for parallel running alongside existing processes; and ongoing optimisation thereafter. Firms should budget for internal resources (compliance, technology and operations staff) during implementation, not just vendor costs.
Regulatory Counsel advises payment institutions and EMIs on RegTech strategy, vendor assessment, outsourcing compliance and FCA supervisory expectations. Contact us for a free initial consultation.
Frequently Asked Questions
Not explicitly, but the FCA has stated that firms using inadequate manual processes when better technology exists may face supervisory challenge. For high-volume firms, automated transaction monitoring is effectively a necessity.
Yes — if the technology supports a critical compliance function, it is likely treated as outsourcing of an important operational function under SYSC 8. Firms must conduct proper due diligence and maintain oversight.
The regulated firm. Outsourcing technology does not outsource regulatory accountability. The FCA holds the firm responsible for the effectiveness of its compliance arrangements.
Costs vary widely by firm size and use case. Transaction monitoring platforms typically range from £20,000–£150,000+ annually. KYC automation platforms charge per-check fees. Total cost should be weighed against reduced manual processing costs and reduced regulatory risk.