RegTech investment followed a relatively clear path for a considerable amount of time. As regulation became more complex and financial crime risks increased, firms focused on technologies that could help them meet compliance obligations more efficiently. That picture is now becoming more nuanced.
AI, digital identity, operational resilience and real-time compliance are reshaping what institutions need from their technology, while tighter budgets are forcing tougher investment decisions. As a result, different parts of the RegTech market are beginning to attract attention for very different reasons.
So, are investment priorities starting to diverge? We recently asked industry leaders where they believe capital is flowing, which areas are gaining momentum, and what that means for the future of the sector.
The Global State of RegTech 2026 – a report co-authored by RegTech Analyst and Parker Lawrence Research – delved into this key topic during the report. You can download the full report here.
As part of the report, vendors and institutions were challenged on a number of key areas within the FinTech market, with the central discussion point being where they expected the greatest level of investment within financial institution’s risk and compliance environments in 2026.
For vendors, expectations are considerably heavy around AI and automation. The report detailed that a huge 91.67% of vendors believe this area will see the greatest level of investment, compared to only 44.33% of institutions.
In the second part of a two-part series, we get the view from a range of key industry thought leaders to hear their opinion on this widening gap between vendors and institutions.
Why are vendors and FIs diverging?
The growing divergence between vendors and financial institutions is potentially bringing two separate ideas of development within the RegTech sector.
However, in the view of Ermanno Ciarrocchi, chief growth officer at Cleverchain, vendors and institutions may not be exactly betting on different futures, but are rather prioritising different layers of the same one, and the layer institutions rate highest is the one that has to exist before the layer vendors rate highest can work.
He said, “In fact, looking at the shape of the two responses, the vendor distribution appears concentrated, almost bimodal, with three tall bars for agentic automation, generative AI and API-based integration, then a cliff.
“By contrast, the institution distribution is a gentle slope, spread fairly evenly across data architecture, cloud, privacy-enhancing technologies, analytics and the rest. The shapes likely differ because the two groups answer from different positions: on one side, vendors build and bring products to market, so they concentrate their expectation on the few categories that define and differentiate those products while, on the other side, institutions own the entire control estate and carry the operational risk for all of it, so they spread their expectation across the whole stack, including the foundations that deployment depends on.”
Therefore, for Ciarrocchi, these foundations are not an alternative to agentic AI, rather its precondition. He stated that agents run on clean, well-governed data, on integrated systems, and on privacy controls that hold under scrutiny, and the categories where institutions lead are exactly the substrate an agent needs to function.
The CleverChain CGO also details the categories where the two sides agree. For example, predictive analytics and network analytics, he says, are the more mature, lower-novelty techniques that neither side treats as a frontier, so here convergence tracks maturity rather than importance.
“In essence, where a capability is well understood, both sides tend to converge, while where it is new and the accountability is still unallocated, as with agents, they diverge most,” he said.
Meanwhile, Areg Nzdejan, CEO of Cardamon, detailed that 91% of vendors rank agentic AI in their top three, whilst less than half of financial institutions do.
“That 47% gap is the largest divergence in the dataset, and it tells you two groups are solving for different time horizons,” he remarked, “Vendors are building for where the market will be, institutions are solving for where they actually are – still investing in data architecture, cloud migration, and PETs because you cannot run intelligent agents over data you cannot access or trust.”
Nzsdejan stated succinctly that vendors are building for institutions that have their data house in order, and a lot of institutions are still building that house.
John Gidla, global head of regulatory research at Vixio, stressed an interesting divergence is starting to emerge between where RegTech vendors are investing their capital and where regulated firms are actually prioritising their spend.
“Look at the marketing material of almost any major RegTech vendor today, and you will see an understandable focus on AI-led transformation, hyper-automation, and predictive capabilities,” he said.
Despite this, behind closed doors, many financial institutions are still wrestling with much more fundamental operational challenges, he said. They are grappling with fragmented regulatory inventories, inconsistent taxonomies, disconnected controls, and manual workflows that threaten governance, auditability, and operational resilience.
Gidla added, “In many ways, the market is entering a crucial “infrastructure phase” of RegTech maturity. While the external conversation is centred around wholesale transformation, internal compliance teams remain focused on building a structured, resilient regulatory architecture that can support that transformation safely and at scale.”
On the other side, Vivox AI CEO Tim Khamzin remarked that the fault line isn’t between firms that adopt AI and those that don’t. It is a choice between vendors optimising for technical capability and financial institutions investing in decision quality.
He explained, “For years, RegTech innovation has largely been measured by technological automation, in other words, what technology is capable of automating. And in those early days, that made sense when the industry was focused on digitising or automating compliance. Today, the question is different. Financial institutions want to know whether technology helps them make faster, better and more defensible risk decisions.”
Marc Salter, managing director, regulatory technology, at ACA Group, made clear his view that the biggest fault line in RegTech today is between vendor hype and client reality.
“Vendors are betting on autonomous AI agents, cloud native rip and replace, and all-in-one suites. But financial services firms need governed, auditable, human-supervised AI, hybrid integrations with legacy systems and specialized tools for high-risk workflows,” Salter commented.
Another interesting opinion comes from Aurimas Bakas, founder and CEO of Copla, who detailed that the gap in this data reflects a structural asymmetry, not a disagremetn about which technologies matter.
“Vendors and institutions sit on opposite sides of the third-party relationship, and that position shapes what each treats as a priority,” he said.
Bakas outlined how vendors concentrate their expectations on transformational AI. He said agentic automation reaches 91.67% in their top-three rankings, with LLMs and API-based integration close behind at 51.67%.
“These are the capabilities vendors build and sell,” Bakas stressed. “Institutions distribute their priorities more evenly and lead on foundational categories: advanced cryptography and PETs at 38.33%, modern data architecture at 36.67%, cloud migration at 26.67%. These are the capabilities institutions have to govern.”
For Bakas, the reason for this divergence is accountability. Every transformational tool a vendor ships, he says, becomes a third-party dependency and the institution carries on its own register.
He added, “Under DORA, that dependency is reportable, and accountability for it stays with the institution regardless of how the vendor positions the product. An institution evaluating agentic automation is also evaluating a new ICT third-party arrangement, a new concentration point, and a new entry in its register of information. That context explains why institutions invest first in the data architecture, integration discipline, and cryptographic controls that let them absorb new tools safely.”
Foundations vs transformation
Are companies prioritising foundations while vendors chase transformation? Khamzin is clear that many firms appear to be prioritising foundations while many vendors continue to emphasise digital transformation.
“Better data, stronger governance and integrated workflows aren’t competing with AI, they’re prerequisites for using it responsibly. Without them, automation simply accelerates inconsistent decision-making,” he said.
The Vivox AI CEO said they’re also seeing a shift in how RegTech is evaluated. He said that the conversation is moving beyond model accuracy and automation rates towards explainability, operational resilience and evidence.
“Regulators don’t supervise AI models in isolation, they supervise the decisions firms make using them. Increasingly, the ability to demonstrate and evidence how a conclusion was reached is becoming just as important as reaching it quickly enough,” he said.
A differing opinion comes from Gidla, who said many organisations are attempting to layer advanced capabilities such as Generative AI and automated horizon scanning onto legacy frameworks that still rely heavily on manual interpretation and siloed workflows.
“In practice, the limiting factor for most compliance departments is no longer access to cutting-edge technology. It is operational readiness,” he said.
The Vixio regulatory research global head added that regulatory expectations are reinforcing this shift.
He said, “Global regulators are placing greater scrutiny on operational resilience, senior management accountability, and algorithmic explainability. This regulatory pressure is pushing firms away from flashy, “black box” solutions and toward systems that are auditable, controllable, and deeply embedded into daily operations.”
Bakas added that the API-based integration line deserves attention. Vendors rank it at 51.67%, institutions at 33%.
He remarked, “Integration is the connective tissue that makes vendor products embeddable, so vendors prioritise it. For institutions, each integration is a new interface to a third party and a new surface to monitor. The same capability reads as opportunity from one side and exposure from the other.”
Meanwhile, Nzsdejan agrees with the sentiment that there are diverging aims between vendors and FIs.
He explained, “Institutions consistently rank infrastructure above transformation. The blockchain gap makes this clear: nearly a quarter of institutions rank it in their top three; vendors are at five percent. Vendors have moved on. Institutions have not.”
The companies getting the most from agentic AI today, the Cardamon CEO made evident, are the ones that have already sorted their foundations.
“At Cardamon, we see this directly – clients with clean data pipelines get dramatically better outcomes from our agents. The AI is rarely the bottleneck. But data can often be the biggest one.”
What lies behind investment gaps
A key question being posed is what the investment gaps that exist reveal about the next phase of RegTech. Ciarrocchi, on this stated his belief that for agentic automation to attract the investment vendors expect, the things institutions are prioritising have to be in place first: data that is clean and governed, systems that are integrated, privacy controls that hold, and outputs an institution can audit, explain and defend to a supervisor.
He added, “The work that turns the agentic forecast into reality sits upstream of the agent, in the substrate and the assurance that make autonomy deployable in a regulated setting. At CleverChain, this is the side of the table we have chosen to build from, treating the foundations institutions prioritise as the requirement to design for.”
Gidla, additionally, sees a shift in buying behaviour. He said that while the appetite for long-term transformation remains, financial institutions are applying far greater scrutiny to implementation realism and measurable operational outcomes.
“They want to know how a tool performs in the messy reality of their existing tech stack, not just how it performs in a sterile sandbox,” he said.
Consequently, Gidla is clear some of the most strategic investment areas over the next few years may not be the most visible and glamorous ones.
He explained that the real battlegrounds will be in regulatory data architecture, controls mapping, workflow orchestration and taxonomy standardisation.
Gidla finished, “The next phase of RegTech competition will be less about who has the most ambitious AI narrative, and more about who can bridge the gap between foundational infrastructure and scalable automation. AI cannot safely automate what it does not structurally understand. The vendors that stand out in this evolving landscape will be those that look past the hype cycle to help firms modernise in a way that is operationally credible, defensible, and built to scale over time.”
Bakas also added, “The investment gap points to where the next phase of RegTech gets decided. Transformational capability only reaches production once the institution can govern it as a third-party dependency. “
He said that vendors which build third-party transparency, machine-readable reporting support, and concentration-risk visibility into the product will close the gap faster than vendors selling capability alone. “The foundations institutions are prioritising are the precondition for the transformation vendors are selling,” he said.
Khamzin, meanwhile, was clear in his view that the next generation of RegTech won’t be defined by who builds the most sophisticated AI. It will be defined by who enables compliance teams to make better decisions, adapt to changing risk in real time and provide a transparent, auditable rationale for every material outcome.
“The competitive advantage is no longer automation itself. It is trusted and traceable decision intelligence,” he finished.
Nzsdejan concluded by stating the next phase will separate firms that built foundations from those that didn’t.
He said, “The institutions investing in data and cloud now are creating the conditions for everything else to follow. Those that skipped that step will hit a ceiling at exactly the wrong moment.”
“The near-total vendor consensus on agentic AI also creates its own pressure – early movers get the advantage, late movers get commoditisation. The architectural choices being made right now will define compliance infrastructure for the next generation of Regtech. This is precisely what we’re building at Cardamon.”
Copyright © 2026 RegTech Analyst
Copyright © 2018 RegTech Analyst
