RegTech Analyst and Parker & Lawrence Research recently released a major industry report looking at the global state of RegTech in 2026. As part of their findings, it noted that financial crime solutions have the highest rate of adoption within compliance but why is that the case.
FinTech Global recently sat down with several leading players in RegTech to get their thoughts on why financial crime solutions are seeing the greatest level of adoption in the sector.
As part of the report, which can be downloaded here, it set out to bring greater structure to the fragmented market. It introduced a simplified RegTech taxonomy that covers 24 subcategories across six major risk and compliance domains. Using this framework, the report established a RegTech Adoption Index to measure relative maturity across the sector.
At the top of that list was financial crime, boasting an Index score of 68. This domain includes solutions that are designed to detect, prevent and respond to crimes impacting financial institutions, such as fraud, money laundering, sanctions evasion and terrorist financing.
Subsectors in this domain include sanctions screening, KYC/KYB, fraud prevention/FRAML, and transaction monitoring. The leading adopters of this technology are payment firms and investment banks.
Why financial crime?
The reasons financial crime solutions have seen greater adoption than other areas could come down to the fact they are an easy starting point.
Karavel CEO Pedro Sousa stated the sector has been dominated by SaaS tools over the past decade that have sought to automate financial crime workflows. As such, compliance professionals have grown accustomed to using external tooling to automate AML and KYC processes. Sousa said, “This mindset makes the barrier to entry lower.”
On the other end, the reason other areas have not seen as much adoption could be down to the fact much of the work has never had automated tools. This is particularly the case for the second line of defence.
Sousa added, “Given that those working on the second line are the ‘thinkers of compliance’, most of the tools available used to be about organising work or enabling collaboration.” The technology that has been a gamechanger for this space is AI and the first tools are only just starting to surface that are capable of automating workflows for the second line. Despite it becoming available it will take time for people to trust the tools as many are still reluctant to pass important work to external tooling creating those barriers to adoption, Sousa said.
As for Lucy Heavens, CMO at Vixio, the reason financial crime solutions have had the best adoption rate is due to the pain being real, immediate and expensive.
The cost of managing anti-financial crime operations is ballooning. A 2024 report from biocatch claimed that 58% of organisations said they spent between $5m and $25m in operational costs related to investigating, combatting and rectifying financial crime issues in 2023. The financial damage from a financial crime failure is also growing, putting poor financial crime processes as a major risk to a financial institution.
Heavens said, “The transaction volumes involved have genuinely outgrown what compliance teams can manually monitor and regulators like FATF, FinCEN, MAS and the FCA are actively pushing risk-based tech adoption as we start to see more threats like deepfakes and synthetic identities.”
Areg Nzsdejan, CEO at Cardamon, had a similar opinion as to why financial crime solutions are leading in the adoption of RegTech solutions. Nzsdejan said, “Because the problem is old, the regulation is clear, and the cost of getting it wrong is very visible.”
Sanctions screening, transaction monitoring and KYC have been regulatory requirements for decades and the workflows are well-understood. On top of that, major public fines, such as those given to Danske Bank and Swedbank, among others, make the stakes impossible to ignore.
He added, “That creates ideal conditions for technology adoption: a defined problem, strong regulatory pressure, and a measurable cost of failure.”
The visible threat from financial crime appears to be the most dominating factor as to why financial crime solutions have seen the most adoption. Corlytics founder John Byrne explained that the regulatory and financial consequences of failure are immediate and severe.
He said, “Global regulators, particularly in the US, continue to impose significant fines and, in some cases, criminal sanctions for shortcomings in areas such as anti-money laundering, sanctions screening and transaction monitoring.”
This need to improve operations around combating financial crime is only more paramount for financial institutions that operate across multiple jurisdictions. Having to manage rules and requirements that differ across regions is becoming increasingly difficult. Technology is quickly becoming the solution to manage the unprecedented level of global regulatory change.
Byrne said, “ For large financial institutions operating across multiple jurisdictions, technology has become the only practical way to meet growing regulatory expectations and monitor financial crime risks at scale and in near real time. This combination of intense regulatory scrutiny, high compliance costs, and clear business value has accelerated investment and adoption far faster than in other compliance domains.”
In addition to the more prominent risk for failure, Napier AI global head of strategy Kevin McGuinness also suggested the increased adoption of solutions in the financial crime domain could be a result of a more active regulatory landscape compared to other areas.
He noted, “The pace of sanctions change since 2022, with roughly 30% year-on-year growth in sanctioned entities, gave firms a deadline rather than a roadmap. And the domain has a measurable operating cost attached to it: when a legacy screening system runs a 5–8% false positive rate, the business case writes itself.”
While financial crime solutions were at the top of the adoption index, at the other end of the list was the ESG domain, with an Index score of 40. This covers solutions facilitating the measurement, management and reporting of environmental, social and governance factors for sustainable investing and corporate responsibility. Subcategories in this domain include ESG ratings, ESG reporting and disclosures, ESG risk management and climate risk quantification.
Sitting just above ESG is the domain of Compliance Management, with an Index score of 44. This refers to solutions helping to address regulatory challenges across multiple domains and frameworks. These are tools that help proactively manage regulatory obligations, changes and assurance activities across the enterprise. Subcategories include regulatory change management, regulatory intelligence, compliance assessment and compliance orchestration.
The reason these are comparatively lower is they carry less risk to the firm. Heavens said, “Compliance management and ESG just don’t carry the same “get it wrong and lose your licence” urgency.
“ESG’s stuck at the bottom of the pile and honestly, that makes sense – nobody’s getting hauled in front of a regulator (yet) for a shaky ESG report the same way they would for missing money laundering. Until that changes, ESG budget is still the “we’ll get to it” line item, not the “drop everything” one.”
In the same vein, Nzsdejan stated, “Compliance Management at 44 and ESG at 40 lack that same forcing function. The obligations exist, but the enforcement track record is thinner and the problem boundaries are fuzzier. Financial crime had twenty years of pain before the technology arrived. Other categories are still in the earlier stages of that cycle.”
In the coming years, McGuinness expects the fastest adoption will be in the domains where regulation has recently become prescriptive, and the underlying data mostly already exists. This includes resilience and third-party risk, driven by the Digital Operational Resilience Act (DORA) and its equivalents, and AI governance, which sits inside the resilience category.
As for financial crime, growth in the domain will come from replacement of existing solutions, rather than new adoption, he said. “A score of 68 reflects broad coverage of first-generation tooling, much of which is now being modernised rather than extended, and that is a different market from the one that produced the original adoption.”
However, despite growth across adoption, McGuinness expects ESG will remain at the bottom of the list until reporting obligations are enforced with the consistency that sanctions obligations already are.
Why is adoption still relatively modest?
The RegTech sector is no longer a niche market. The global RegTech market is estimated to be worth $29.3bn in 2026. It is also projected to grow rapidly and become valued at $112.1bn by 2033. Despite the size of the market, the scores on the adoption index suggest the adoption of RegTech solutions is still rather modest across financial services.
McGuinness said the adoption rate is not due to a lack of appetite. The Global State of RegTech report noted that two-thirds of financial institutions are planning to increase their RegTech spend in 2026. Slow adoption is instead caused by the constraints of the underlying architecture.
“A firm can buy an excellent solution and still not reach scaled enterprise use if rule changes take months to implement, if latency prevents real-time decisions, and if every new tool has to be threaded into a stack that was never designed for it.
“Vendor change requests costing $25,000 (USD) and a month’s delay for a configuration change are still common. Add the accountability question — someone has to personally defend the system’s output to a supervisor — and cautious, partial deployment becomes a rational response rather than an inexplicable one. Investment is flowing into products faster than institutions can absorb them, and that is a foundations problem, not a procurement one.”
Heavens also pointed to the barrier legacy technology creates for RegTech solutions. Unfortunately, Heavens doesn’t think they are going away.
“Persistent structural barriers to adoption centre on legacy infrastructure, fragmented data and the complexity of integration.” A report from this year highlighted that more than half of financial institutions surveyed cited legacy systems as a significant barrier to adopting third-party Regtech solutions.
Heavens added, “It’s not that firms don’t want new tools, it’s that ripping out systems they’ve sunk billions into is genuinely painful and integrating shiny new AI on top of 30 year old core banking rails is a nightmare nobody’s cracked at scale.
“Instead vendors should stop selling ‘rip and replace’ and sell integration first, API native tools that sit on top of legacy stacks rather than demanding firms tear them out. Vendors who lead with “we plug into what you already have” will win the trust battle faster than ones who lead with ‘modernise everything.’”
Nzsdejan also highlighted that adoption is still being constrained by integration complexity, data quality, and a lack of clarity on what good looks like. These are the same problems that held back financial crime adoption a decade ago.
“The difference is that financial crime had repeatable workflows to automate consistently across customers. Others have fuzzier workflows with more divergence with how it’s done firm to firm – the unlock is AI, which can handle less deterministic work.”
There is also the problem of fragmentation. Firms have accumulated an array of point solutions that work in isolation, “adding another tool to a compliance stack that’s already hard to manage feels like the wrong move,” he said.
Byrne also pointed to the challenge caused by point solutions. While point solutions are often easier to adopt, it can quickly become overwhelming when there are multiple individual solutions that do not connect, removing much of the efficiency they were meant to bring.
“Today, firms are looking beyond standalone regulatory monitoring tools and are focused on connecting the entire compliance lifecycle, from horizon scanning and regulatory change management through to obligations, policies, controls, risk assessment and reporting. Achieving that level of integration is significantly more complex than deploying a single solution.”
Another adoption barrier is the increasing complexity and fragmentation of the regulatory environment, he stated. Firms are now having to manage multiple jurisdictions, frameworks, taxonomies and languages, often this is required simultaneously. This is pushing more firms towards a more strategic approach to technology. They are focusing on solutions that can integrate data, processes and workflows in a scalable operating model.
“The next wave of adoption will be driven by platforms that help organisations connect these previously disconnected activities and create a more efficient, end-to-end compliance process.”
One final barrier to adoption is a lack of trust in AI. Heavens stated that while AI adoption within RegTech is accelerating, it still requires care. Regulators are starting to build and deepen frameworks that cover AI operations and a common requirement is the need for explainability, fairness and strong governance.
Heavens said, “Compliance teams can’t deploy something they can’t defend to an auditor so “the AI said so” is not an answer anyone’s willing to put their name to yet.”
She urged financial institutions to build AI governance frameworks before they look to scale AI tools, rather than trying to retrofit it after a regulator comes probing.
Where will adoption grow the fastest?
The regulatory and technology landscape are both evolving at such a rapid pace that it is impossible to know for certain what domains will see the greatest adoption. However, there are a number of factors that could build the perfect environment for adoption in certain spaces.
Heavens pointed to two areas attracting the biggest adoption in the coming years. The first is regulatory intelligence. She pointed to research highlighting how regulatory intelligence is set to grow at a CAGR of 16.6% between 2026 and 2035, outpacing the current leaders of risk and compliance management.
She said, “Financial institutions should be investing now in tools that surface what regulatory change actually matters to them, not generic feeds. Tech providers building in this space, like Vixio, are doubling down – this is where the growth curve is steepest and the incumbents haven’t fully consolidated it yet.”
The second area positioned for notable adoption in the coming years is AI-powered compliance tooling. She noted that adoption of generative AI to streamline regulatory compliance frameworks has quickly become a headline market trend and could become a core growth driver in the space in the coming years.
She said, “The direction of travel is clear even if the exact dollar figures vary by report.
“Tech providers shouldn’t be building AI washed versions of old tools. Instead they need to build for the explainability and audit trail problem from day one because that’s what will actually unlock enterprise budget and gain trust from the financial institutions.”
As for Nzsdejan, he sees compliance management as the most obvious section to see greater adoption in the coming years. He pointed to the growing volume of regulations across jurisdictions and how it is becoming unsustainable to keep pace with the change with manual workloads. Instead, AI-native platforms can track, interpret and map obligations automatically.
The second area he sees having strong adoption is AI governance within the domain of resilience. The Resilience category covers solutions that ensure the continuity of critical business services by enabling firms to prepare for, respond to and recover from disruptions across operational and third-party environments. It includes the subcategories AI governance, third-party risk, incident response and enterprise risk management.
Nzsdejan said, “Every firm deploying AI now has a new third-party risk and model governance problem. Regulators are already signalling expectations – the EU AI Act, the FCA’s model risk guidance, the PRA’s focus on algorithmic accountability. That regulatory pressure will drive adoption in the same way AML regulation drove financial crime adoption. The firms building for that now will be well ahead when enforcement catches up.”
Finally, Byrne believes the biggest growth opportunities will be for integrated NFRM ( policy management, controls management and regulatory operating models), unlocking risk quantification and automation.
He said, “As regulatory environments become more complex and change more rapidly, firms will need greater automation to translate regulatory requirements into actionable obligations, policies, controls and risk management processes. Organisations are increasingly looking for solutions that not only identify regulatory change but also help them understand the downstream impact on their business and automate compliance activities wherever possible.”
At the centre of this will be AI, which will help firms map regulatory requirements across different jurisdictions, languages and taxonomies. However, he believes the real value will come from connecting regulatory intelligence, risk, controls and compliance execution within a single operating model.
On a final note, he said, “The next wave of RegTech adoption will be driven by platforms that connect regulatory intelligence, obligations, policies, controls and risk into a single operating model, enabling firms to manage compliance more efficiently and at greater scale.”
Copyright © 2026 FinTech Global
Copyright © 2026 RegTech Analyst
