Introduction to RegTechمقدمة تقنية الامتثال RegTech

RegTech (تقنية الامتثال) is the software a financial institution buys to carry out its duties towards its regulator: screening customers, monitoring transactions, and preparing reports.

Not the regulator, and not a substitute for a licence. It is an entire industry built on one problem: regulatory duties grew until doing them with staff and spreadsheets became impossible.

Why this industry exists at all

Start with the size of the problem. A mid-sized Saudi bank processes millions of transactions a month. The rules require it to know every customer, screen every counterparty against sanctions lists that change weekly, notice unusual patterns, and later prove it did all of that. There is no headcount that does this by hand.

The price of failing is not theoretical. BNP Paribas paid a 8.9 billion dollar penalty in 2014 for breaching US sanctions. TD Bank paid roughly 3 billion dollars in October 2024 for anti-money-laundering failures. Numbers like those are what make an executive sign off on a tool costing millions without hesitating.

That is where RegTech (تقنية الامتثال) came from. It is the software a licensed firm buys to carry out these duties at machine speed and leave a trail an auditor can still read two years later.

What stays with the firm

People confuse the tool with the responsibility. A supervisor does not fine the vendor when a check fails. It fines the licensed firm. The licence is in that firm's name, the compliance officer is its employee, and the penalty comes out of its account.

In practice this means buying the best tool on the market does not move the risk onto whoever sold it. The firm remains responsible for choosing the tool, tuning its settings, and reviewing what it produces. If an investigator closes a thousand alerts with one click without reading them, the tool worked and the firm failed.

The four product families

First, identity products, which answer one question: is this person real, and are they who they claim to be? Sumsub, Onfido and Jumio are among the best-known vendors globally. In Saudi Arabia the shape of this product changes completely, because Nafath offers direct government-backed verification, so a foreign vendor's value shifts to covering non-residents and companies rather than verifying a citizen.

Second, AML monitoring, which watches account behaviour rather than the signup moment. ComplyAdvantage, Napier and NICE Actimize sell here.

Third, fraud platforms, which look similar and aim at something different: fraud is a loss of money that is yours, money laundering is a crime whose money passes through you. Featurespace and Sift are examples.

Fourth, evidence and reporting tools, which turn all of the above into a pack an auditor opens. That is the subject of the last article in this part.

The problem the buyer actually lives with

You will not understand this industry until you know its biggest complaint: false positives (الإيجابيات الكاذبة). AML monitoring is usually tuned to high sensitivity, because missing a real case is far more dangerous than opening a spurious one. The result is that the large majority of alerts at many firms end with no suspicion at all, commonly estimated in practice at over ninety percent.

Picture what that means. A team of thirty investigators spends its days closing clean cases, costs a large annual salary bill, and still carries the risk that the one real case is lost in the noise. So what a customer is really buying is not "catching crime". It is less noise at the same sensitivity.

That explains why a professional buyer asks questions that sound dull. How many alerts per thousand transactions? Can I change a rule myself or do I wait for the vendor? Does the system explain the reason for an alert in language an auditor understands?

What makes a product acceptable

Case management (إدارة الحالات) is the heart of the product, not the dashboard. Every alert needs an owner, a time, a decision, and a written reason for that decision. The system of record is the case file, because that is what gets reopened two years later when an auditor asks about one specific transaction.

Here a working rule appears that everyone in this field knows: if the decision was not written down, it did not happen. The memory of an investigator who has left the company is no use in an audit, and a numeric score alone does not explain why a transfer was allowed through.

Build or buy

Every engineering team meets this question early. The sanctions list itself is downloadable, and writing code that compares one name to another looks like a week of work.

The trap is that the hard part is not the code. Arabic names are transliterated many ways, and one man may appear as Mohammed, Mohamed or Muhammad. Sanctions lists change weekly and someone has to track them. What a serious vendor actually sells you is three things rather than one: a matching algorithm that survives spelling variation, continuous list updates, and contractual liability when the system fails.

So the common pattern today is buy the checks, build the orchestration. You buy screening engines from specialist vendors and build the layer that wires them into your own signup flow and decides when each engine is called. Companies now sell that layer too, Alloy among them, because many firms run more than one vendor and need to swap one out without rebuilding everything.

These products are usually priced by consumption: an amount per identity check, or per thousand monitored transactions, with an annual minimum and seat fees for investigators. That means compliance cost grows as your customer base grows. It belongs in your product's pricing from day one, not a year later.

The Saudi context

The buying equation changes locally for two reasons. The first is Nafath and Yakeen, which make verifying a citizen or resident faster and cheaper than in markets with no unified digital identity. The second is rail speed: mada and sarie move money in seconds, and an instant transfer is not easily clawed back. Every minute of delay in an alert means money that has actually gone.

So a vendor is not chosen on its global logo alone. It is chosen on how well it integrates with local rails, and on whether it can produce evidence in the shape a supervisor or a partner bank asks for before raising limits.