RegTech That Actually Works: Moving Beyond Checkbox Compliance

The box-ticking era is running out of road. The firms getting real value from RegTech are using it to reduce risk and free up room to innovate, not to produce prettier evidence for the regulator. Here’s what that looks like in practice.

There’s a growing weariness in financial services about “checkbox compliance” – buying a RegTech tool, mapping it to the rulebook and calling the job done, without changing how much risk the business actually carries. For scaling firms, that approach is wearing thin. RegTech now has to earn its place: something that genuinely reduces risk, stands up to a supervisor years later, and gives the business room to try new things.

The shift is from “proof that we followed the steps” to “proof that the risk went down” – less about which tool you bought, more about what it does to your exposure.

“RegTech was supposed to make compliance better. It was supposed to make things a lot easier. So today we’re asking the big question: what does RegTech that actually works look like?”

Amanda Harrison, Senior Advisor, fscom

Compliance isn’t the brake on innovation

If your compliance strategy starts and ends with satisfying a checklist, you’re missing the bigger opportunity. Supervisors can – and do – approve genuinely new models when firms make the case on risk rather than process. Axiology, a capital markets infrastructure start-up run by a former central bank supervisor, has applied to ESMA under the DLT pilot regime to trade equities, fixed income and fund units on a public chain.

“Who doesn’t want to be compliant? Everyone wants to be compliant. But if you’re in the business of running innovative things, you’re always trying to break the rules in a good sense. I couldn’t have dreamed that running securities on a public chain would ever be approved by a supervisory authority. I was proven wrong. That is the opposite of checkbox compliance.”

Marius Jurgilas, CEO, Axiology

Safety in numbers isn’t the same as safety

The clearest RegTech wins are in KYC, AML and client onboarding, where almost nobody builds in-house any more. That creates a comfortable herd: if the whole market uses the same provider and it fails, no single firm takes the blame. Axiology saw this first-hand when its third-party reporting provider failed to update a database – the supervisor was relaxed, but the firm still faced a grilling on how to stop it happening again.

And buying a tool never buys away the accountability. The firm still owns its inherent risk, its controls and its residual risk.

“If 90 percent of my competitors are using this or that RegTech solution, I feel safe – because if something is wrong, it’s not only me. The counter side is that sometimes it’s not compliance, it’s complacency. And that needs to be counterbalanced.”

Marius Jurgilas, CEO, Axiology

Data is the real building block

As AI and agentic frameworks take over delivery, compliance teams are shifting from doing the work to monitoring it – and the question moves from “is the control in place?” to “is the data underneath it good enough?” Treated like Lego, the same pool of data can serve several regulations and the growth agenda, rather than being bought twice. AI is also making it easier to build compliance tools in-house, which makes the RegTech market far more competitive.

The number to watch is evidence. A decision has to be defensible years later – which means knowing where the data came from, how fresh it was and whether it has changed.

“It’s not just matching a process. It’s about being able to evidence your thought process in five years – having the reconstructability, and being able to show the evolution of that data. It puts the focus on what risk is actually being mitigated, rather than ‘I have 12 steps and I’ve met the 12 steps’.”

Francis Mariniere, Compliance Director, Moody’s

The takeaway

RegTech that works is about moving from ticking boxes to cutting real risk. Know what each tool actually covers, guard against the complacency of following the herd, and invest in data you can reuse and defend years from now – and compliance stops being a cost centre and becomes room to innovate. Or as Jurgilas put it: “There will always be business for those who are doing regulatory compliance.”

The Scaling Checklist

• Map tools to risks, not rules. For every RegTech product you run, name the specific risk it reduces and the gap it leaves. If you can’t, you’ve bought a checkbox.

• Stress-test your provider. Assume your third-party tool fails tomorrow. Know how you’d spot it, who you’d tell and how fast you’d fix it.

• Make your data defensible. Check that every compliance decision can be reconstructed in five years – source, freshness and all – and reuse that data across regulations instead of buying it twice.

These perspectives are drawn from the Regulation Reimagined panel “RegTech That Actually Works: Moving Beyond Checkbox Compliance”, moderated by Amanda Harrison (fscom), with Francis Mariniere (Moody’s) and Marius Jurgilas (Axiology).

Get Involved with Fintech Week London 2027

Fintech Week London returns 20-24 September 2027: five days across the city, built around the two-day Summit on 21-22 September, where founders, investors, operators and regulators come to connect, collaborate and do business in the world’s number one fintech ecosystem.