A woman in Columbus opens a checking account on her phone while waiting for a bus. She photographs her driver’s license, takes a selfie, types her Social Security number, and sees an approval screen in under two minutes. It feels like a form. It is closer to a chain of regulatory decisions made by software.
That software is RegTech, short for regulatory technology.
It automates the work of proving to regulators that a financial institution knows its customers, monitors their activity, and can document every decision it made. In the United States, those duties are legal obligations, not product features.
The rules the software serves
The foundation is the Bank Secrecy Act of 1970, expanded in significant respects by the USA PATRIOT Act of 2001. Together with implementing regulations, these laws establish requirements for financial institutions’ anti-money laundering (AML) programs, customer identification, and reporting of suspicious activity to the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury. FinCEN’s Customer Due Diligence (CDD) Rule also requires covered financial institutions to identify and verify the beneficial owners of legal-entity customers, including individuals who directly or indirectly own 25% or more of the entity, as well as an individual with significant responsibility to control, manage, or direct the entity. OFAC, meanwhile, administers U.S. sanctions programs and publishes sanctions lists that financial institutions use for sanctions compliance and screening.
Before RegTech, analysts did much of this with spreadsheets, paper files, and overnight batch reports. The software now handles the repetitive layers. Those layers are the product’s core features.
Core features
Identity verification. Verification and authentication are different. Verification asks whether a person is who they claim to be when the relationship begins. Authentication asks whether today’s login belongs to the person who was verified.
During onboarding, a platform typically checks a document for tampering, compares the selfie to the ID photo, and cross-references the name, address, date of birth, and ID number against credit bureau and other data sources. Innocent applicants can fail these checks: a recent move, a thin credit file, a bad camera.
This is where a common internet question gets a harder meaning. Most people asking how to find people online want to reconnect with a classmate or vet a business contact.
A compliance system asks something stricter: is this identity real, does it belong to this applicant, and does it match anyone on a sanctions or watch list? Finding a person is easy. Proving the person in front of you is that person is what regulators care about.
Sanctions and watchlist screening. Names are matched against OFAC and other lists. Because names are spelled inconsistently across languages, the software uses fuzzy matching, which produces false positives that humans must clear.
Transaction monitoring. After onboarding, software evaluates account activity against scenarios. Some are plain rules, such as repeated cash deposits just under the $10,000 threshold that triggers a Currency Transaction Report, a pattern called structuring. Others are statistical or machine-learning models that compare a customer’s behavior with their own history and with similar customers, producing a risk score.
A high score does not mean a crime occurred. It generates an alert for a human investigator, who closes it or escalates to a Suspicious Activity Report. The model ranks. The institution makes the legal judgment.
Automated reporting and audit trails. Platforms assemble data for regulatory filings, track deadlines, and keep a record of who reviewed what, when, and why.
Examiners from the OCC, the Federal Reserve, the FDIC, or state regulators judge a bank partly on whether its decisions are documented and consistent, not just whether they were correct.
Regulatory change management. Text-analysis tools track new rules and guidance and map them to an institution’s internal policies and controls.
It is the least glamorous feature and arguably among the most useful, since a missed update can become an examination finding months later.
Why timing changes the design
Payment mechanics shape how these tools work. A card purchase is authorized in seconds, but clearing and settlement happen later, which leaves room to reverse or dispute.
Newer rails such as The Clearing House’s RTP network and the Federal Reserve’s FedNow service make credit transfers effectively final once sent. That compresses fraud and sanctions screening into the moments before funds move. For institutions on those rails, monitoring has to run in-line rather than overnight, and the cost of a wrong approval rises because there is no easy reversal.
Benefits, with qualifications
Speed. Automated onboarding can turn a multi-day process into minutes, and a faster path to an account is a real gain, especially for customers who found paper-based processes burdensome.
Consistency. Software applies the same logic to every case, which helps in audits and reduces variation between individual reviewers.
Efficiency. Automation can cut manual effort in alert review and reporting, letting analysts concentrate on complex cases. Machine-learning vendors mostly pitch this as alert prioritization, because monitoring systems have long been criticized for generating far more false alerts than genuine leads.
Earlier detection. Spotting suspicious patterns sooner can reduce exposure to regulatory penalties and to the underlying crime.
Three caveats apply.
First, savings depend on implementation. A system that produces more alerts than staff can review adds cost instead of removing it.
Second, consistency is not fairness. A model trained on incomplete or skewed data can systematically flag certain customers, and the pattern may be hard to see from inside the institution.
Third, accountability does not transfer. Buying a platform does not move legal responsibility to the vendor, and US banking agencies have said plainly that banks must manage the risks of their third-party relationships.
Use cases in the US market
Banks and credit unions use RegTech for AML monitoring, sanctions screening, and regulatory reporting. NICE Actimize is among the platforms commonly cited in this category.
Fintech lenders and digital account providers use identity-verification vendors, such as Trulioo, to onboard customers remotely. Many fintechs operate through partner banks, which means the bank’s compliance obligations flow down to the fintech’s processes and vendors. The bank remains answerable to its regulators for what its partner does.
Payments companies and crypto exchanges registered as money services businesses face their own versions of the same duties, enforced through FinCEN and state licensing regimes. Their monitoring needs differ from a bank’s because their customers, products, and transaction patterns differ.
Broker-dealers and insurers apply similar AML principles under their own regulators, with software adapted to their products.
Large multinational firms use regulatory-change tools to match new laws to internal controls, a use case that has less to do with crime and more to do with keeping pace with rulemaking.
The decision you didn’t see
Return to the woman at the bus stop. Her account was approved because a document check passed, a selfie matched, a database confirmed her address, and a sanctions screen came back clear. Had any of those wobbled, she might have been routed to manual review or declined, perhaps with a generic message and no clear path to learn why.
That is the tension the product pages rarely resolve.
The automation that makes onboarding quick also moves consequential decisions into systems most customers cannot inspect, built primarily to satisfy regulators. A decision made faster and more consistently by software is probably better than one made slowly and unevenly by a person, at least often. But when the software is wrong, who does she ask?