Last year, a mid-sized European bank received a fine exceeding EUR 4 million. Not for money laundering. Not for fraud. The bank had failed to file accurate transaction reports under MiFID II for a period of several months. The reporting logic was correct in theory, but a regulatory amendment had changed how certain OTC derivative trades were classified, and the compliance team had not caught the update in time. They were monitoring roughly 300 regulatory bodies across 40 jurisdictions. The amendment was one of an estimated 80,000 regulatory alerts published globally that year.
This is the problem that RegTech, at its best, is supposed to solve. Not just anti-money laundering (AML), which tends to dominate the conversation, but the broader operational machinery of compliance: tracking regulatory change, filing accurate reports, surveilling trades for manipulation, monitoring employee communications, and screening entities against sanctions lists that shift daily. Each of these functions has its own workflow, its own regulatory mandate, and its own failure modes.
The companies building technology for these functions are maturing. Some have been acquired by larger risk management platforms. Others remain independent. What follows is an honest assessment of where AI is making a measurable difference in the RegTech stack, and where the marketing still outruns the reality.
Regulatory Change Management: The 80,000-Alert Problem
Thomson Reuters Regulatory Intelligence tracked an average of 220 regulatory change alerts per day as of its last published benchmark. Across a year, that exceeds 80,000 discrete updates spanning rule proposals, final rules, guidance documents, enforcement actions, and amendments from regulators worldwide. For a global bank subject to rules from the SEC, FCA, MAS, BaFin, ESMA, and dozens of other bodies, the challenge is not awareness. It is relevance. Which of those 80,000 updates actually changes an obligation my institution must meet?
Ascent RegTech (now rebranded as AscentAI following its 2025 rebrand and acquisition of UK-based Waymark) takes what it calls an "obligations-centric" approach. Rather than organizing regulatory content by document or topic taxonomy, Ascent's platform extracts individual obligations from regulatory text and maintains them as discrete objects. When a regulator amends a rule, the system parses the amendment and maps it against the institution's existing obligation inventory. The company cites a striking benchmark: ING and Commonwealth Bank of Australia generated their MiFID/MiFID II obligation inventory in 2.5 minutes using Ascent, compared to 1,800 hours when done manually. That is not a marginal improvement; it is a categorical shift in how obligation mapping works.
Compliance.ai (acquired by Archer in February 2024) built its platform around a patented Expert-in-the-Loop (EITL) machine learning system. The core claim is noise reduction: filtering an annual document review load from roughly 25,000 items down to approximately 585 relevant ones. The platform maps regulatory changes to internal policies, procedures, and controls, which is the step that most compliance teams still do in spreadsheets. Since the Archer acquisition, Compliance.ai has been folded into a broader integrated risk management suite, which may appeal to firms already using Archer for GRC but could concern teams that valued its independence.
The gap between these platforms and compliance reality is straightforward: the AI is good at classification and relevance scoring, but the "last mile" of assessing whether a regulatory change actually requires a policy update or a control modification still depends on human judgment. No vendor has automated that step reliably. Teams evaluating regulatory change management tools should ask not just how well the system classifies updates, but how it integrates with their existing policy management workflow.
Automated Regulatory Reporting: MiFID II, Dodd-Frank, and Basel III
Regulatory reporting is, at its core, a data engineering problem. MiFID II transaction reporting alone requires 65 fields per trade, submitted to the National Competent Authority (NCA) by the close of the next business day (T+1). Each field must be accurate, and the reporting logic must account for instrument classification, counterparty identification via Legal Entity Identifiers (LEIs), and trade lifecycle events. The September 2025 deadline for transposing the latest MiFID II/MiFIR amendments introduced new eligibility rules for OTC derivatives and raised data quality expectations in anticipation of the EU consolidated tape.
Dodd-Frank reporting obligations under the CFTC carry their own complexity, particularly for swap data reporting. Basel III reporting requires granular capital adequacy calculations that pull from risk-weighted asset models, liquidity coverage ratios, and net stable funding ratios. These are not simple form-fills. They are computational workflows where errors cascade.
The technology response has largely come from specialized reporting vendors and larger financial data platforms (Bloomberg, LSEG, SteelEye) rather than pure-play AI startups. Where AI adds value is in the quality assurance and reconciliation layer. Automated three-way reconciliation, comparing source trade data against the Approved Reporting Mechanism (ARM) submission and the regulator's record, can catch discrepancies that manual spot-checks would miss. The firms getting fined are typically not those with bad reporting logic; they are the ones who did not detect that their logic had drifted out of alignment with a regulatory amendment.
For compliance teams, the evaluation criterion here is not "Does it use AI?" but rather "Can it detect when our reporting logic no longer matches the current rule?" That is the failure mode that matters.
Trade Surveillance: Finding the Signal in Market Noise
The trade surveillance market is projected to surpass USD 9.3 billion by 2033, driven by regulatory enforcement around spoofing, layering, and cross-venue manipulation. MAR (Market Abuse Regulation) in the EU and FINRA/SEC rules in the US require firms to monitor trading activity for signs of market manipulation, and regulators increasingly expect that monitoring to be technologically sophisticated.
Traditional surveillance systems used deterministic rules: if a trader places and cancels orders above a certain threshold within a certain time window, flag it. These rule-based systems generate enormous false positive rates, and they are blind to strategies that span multiple markets or asset classes.
AI-based surveillance systems learn behavioral baselines for individual traders and desks, then flag deviations from those baselines. The approach is better suited to detecting spoofing and layering because these strategies are defined by intent and pattern, not by simple threshold crossings. Nasdaq embedded AI capabilities into its surveillance platform in late 2025 following a successful pilot, offering predictive analytics and cross-market correlation to its exchange and broker-dealer clients.
Napier AI, while primarily known for AML transaction monitoring, has built a broader compliance analytics capability. The company's 2025-2026 benchmark report found that traditional rule-based monitoring has created "unsustainable workloads and excessive false positives," and that institutions moving to contextual detection models achieve measurably better accuracy. Napier's approach emphasizes explainability, which matters because regulators in the EU, US, and APAC are converging on the expectation that AI-driven surveillance must produce auditable reasoning, not just scores.
The honest assessment here: AI materially reduces false positives in trade surveillance, and it detects cross-market patterns that rules cannot. But it does not eliminate the need for experienced surveillance analysts. The AI generates leads. Humans build cases.
Communications Surveillance: Beyond Keyword Matching
MiFID II and FINRA Rule 3110 require firms to monitor employee communications for conduct risk, including emails, instant messages, mobile texts, voice calls, and increasingly, platforms like WhatsApp, Teams, and Slack. The compliance challenge is staggering in volume: a mid-sized broker-dealer might generate millions of messages per month.
SAIFR, incubated within Fidelity Labs, has carved out a distinctive position in this space. Rather than general-purpose surveillance, SAIFR focuses on the intersection of AI and compliance language. Its Communication Compliance Agent, launched in collaboration with Microsoft at Build 2025 and integrated into Microsoft Azure AI Foundry, analyzes both human-generated and LLM-generated content for potential regulatory violations. The system is trained to identify noncompliant language under regulations such as FINRA Rule 2210 (communications with the public). SAIFR reports detection accuracy of 93-95% compared to human compliance reviewers, deliberately leaving the remaining 5-7% of complex, judgment-intensive cases for human analysts.
In January 2026, SAIFR announced a partnership with Superhuman (formerly Grammarly), embedding its compliance agent directly into the Superhuman Go writing environment. This is a notable architectural choice: rather than surveilling communications after the fact, SAIFR provides real-time alerts and suggestions as employees write. It shifts compliance from detection to prevention.
The key question for communications surveillance is false positive rate. Legacy keyword-based systems flag enormous volumes of benign messages, drowning compliance teams in noise. SAIFR's approach, using models trained on regulatory language rather than simple keyword lists, addresses this directly. But firms evaluating the tool should ask about calibration: SAIFR emphasizes that risk appetite varies by institution, and the model requires client-specific tuning.
Sanctions Screening: Real-Time Matching at Scale
Sanctions lists are not static. OFAC, the EU, HM Treasury, and the UN update their lists frequently, and geopolitical events can trigger additions within hours. A compliance team screening customers against yesterday's list is already behind.
ComplyAdvantage has built its business around the speed of its data. The platform updates system-wide every hour based on global sanctions lists, watchlists, adverse media, PEPs (Politically Exposed Persons), and warning lists. It screens against over 100 international and national sanctions lists and thousands of global regulatory and law enforcement watchlists. The AI layer uses natural language processing to identify sanctioned entities even before official notifications, accounting for global naming conventions, transliterations, and aliases that simple fuzzy string matching would miss. ComplyAdvantage reports reducing onboarding time by up to 83% with a 66% increase in straight-through processing.
The 2025 context is stark: ComplyAdvantage's State of Financial Crime 2025 report found that 44% of surveyed firms identified lack of real-time risk visibility as their biggest compliance barrier, and 43% said their biggest limitation was inability to screen against dynamic sanctions lists. Meanwhile, regulatory fines globally increased by 417% in the first half of 2025 compared to the same period in 2024, totaling approximately $1.23 billion.
Hummingbird expanded its platform in September 2025 to include integrated customer screening for sanctions, PEPs, and adverse media across the customer lifecycle. The system supports automated screening at onboarding, ongoing monitoring, and ad-hoc manual re-screening. Its partnership with OpenCorporates gives investigators direct access to a database of over 200 million companies from within the Hummingbird platform, which addresses a common pain point: verifying beneficial ownership structures during Enhanced Due Diligence (EDD).
Lucinity, based in Reykjavik, approaches financial crime compliance through what it calls a "Human AI Operations" model. Its AI agent, Luci, automates investigative tasks such as transaction analysis, money flow mapping, and draft SAR (Suspicious Activity Report) generation. Lucinity won the Silver Award for Best AML Transaction Monitoring Innovation at the 2025 Datos Insights Fraud & AML Impact Awards, and was recognized in the 2025 Gartner Market Guide for Anti-Money Laundering. The company's clients include Visa and Trustly. Its "Time Travel" feature, which lets compliance teams retroactively test and tune detection rules against historical data, addresses a persistent problem: how do you know whether a rule change improves detection without waiting months to find out?
Practical Evaluation Criteria for Compliance Teams
Having watched RegTech vendors pitch to compliance teams for years, I would suggest these questions matter more than any marketing deck:
1. Integration depth, not feature count. Does the tool plug into your existing GRC platform, case management system, and data warehouse? A brilliant standalone tool that creates another data silo is a liability.
2. Explainability under regulatory scrutiny. If a regulator asks why a particular alert was generated or suppressed, can the system produce a clear, auditable explanation? "The model said so" is not an acceptable answer. Regulators in the EU, US, and Singapore are all converging on this expectation.
3. False positive reduction with evidence. Every vendor claims to reduce false positives. Ask for measured results from comparable institutions, not just percentages from a lab environment.
4. Regulatory change responsiveness. How quickly does the system incorporate new regulatory amendments? How does it handle ambiguity in draft rules? What happens when two regulators issue conflicting guidance?
5. Calibration and customization. Risk appetite varies by institution. A tool that works perfectly at a global systemically important bank (G-SIB) may generate irrelevant noise at a regional credit union. Ask how the system adapts to your institution's specific regulatory perimeter.
6. Human-in-the-loop design. The best RegTech tools do not replace compliance officers. They eliminate the repetitive, high-volume work that buries teams in administrative tasks, freeing analysts to focus on the judgment calls that actually require expertise.
The RegTech market in 2025 is about operational efficiency at scale, applied to a regulatory burden that continues to grow. The companies profiled here represent genuine progress, but progress that still requires experienced compliance professionals to direct, calibrate, and oversee. The technology is the instrument. The compliance team is the operator.