RegTech, SupTech and sandboxes: what they are and why they appeared

Three terms

In October 2020 the Financial Stability Board published a report, prepared for the G20, on the use of supervisory and regulatory technology. It describes SupTech as applications of financial technology used by authorities for regulatory, supervisory and oversight purposes, and RegTech as applications of financial technology used by regulated institutions for regulatory and compliance requirements and reporting.

A World Bank note of 2020 defines a regulatory sandbox as a virtual environment that enables live testing of new products or services in a controlled and time-bound manner. It describes an innovation hub as a central contact point that answers queries and gives support, advice and guidance, and notes that, unlike a sandbox, a hub does not generally include the testing of products or services.

• RegTech: technology used by the firm to comply and to report.
• SupTech: technology used by the authority to supervise.
• Sandbox and innovation hub: arrangements an authority sets up to deal with new products and new firms.

Why their use grew

The Financial Stability Board separates the reasons into demand and supply. On the demand side are, among others, the larger volume of data that regulatory requirements produced after the 2008 financial crisis, the wish for more efficient collection of regulatory data and for more forward-looking supervision, the needs of cybersecurity and of preventing financial crime, and a growing number of supervised entities, including financial technology firms.

On the supply side are new analytical tools such as artificial intelligence and machine learning, the greater availability of data, cloud computing, and better ways of organising data, such as interfaces through which systems exchange it.

What they are used for

According to the same report, the most common uses of SupTech by authorities were regulatory reporting and data management, and artificial intelligence was the most widely deployed SupTech tool. Among regulated institutions, the main uses of RegTech were fraud detection, regulatory reporting, risk management, and anti-money laundering and countering the financing of terrorism, with know-your-customer checks and identity verification growing.

For a lender the two sides meet in the same data. The figures a lender’s systems produce for its own monitoring are, increasingly, the figures a supervisor collects and analyses. Lessons 2 and 3 take each side in turn.

Sandboxes around the world

The World Bank counted 73 financial technology sandboxes operated by 57 countries, using data from April 2020. In a November 2020 summary of its data, it reported that about 56 percent of the sandboxes had been created in 2018 and 2019, that emerging markets and developing economies accounted for about 70 percent, and that the East Asia and Pacific region had the highest number, followed closely by Europe and Central Asia, while North America and South Asia had the fewest. It counted 23 sandboxes related to financial inclusion.

Two limits apply. East Asia and Pacific is a World Bank region that includes Southeast Asia together with China, the Pacific islands and other economies, so it does not describe Southeast Asia alone. And a count of sandboxes says nothing about how many firms were tested in each, or with what result. The World Bank also cautions that sandboxes are not a panacea and are not the only mechanism for fostering innovation; it found that testing periods ranged from two weeks to two years, with one year the most common.

Exceptions-based supervision

Among the benefits it lists, the Financial Stability Board names exceptions-based supervision: data are checked against parameters set in advance, and outliers are flagged for a supervisor to look at.

Example, for illustration only: a supervisor receives quarterly figures from 40 lenders. Its rule flags any lender whose share of loans more than 30 days overdue rose by more than 2 percentage points in a quarter. A lender whose share rose from 4.5 percent to 7.0 percent has risen by 2.5 points and is flagged; one that went from 6.0 percent to 7.5 percent has risen by 1.5 points and is not. If 3 of the 40 lenders are flagged, the supervisor starts with those 3. The rule directs attention; it does not decide anything about a lender.

Change = share overdue this quarter − share overdue last quarter; the lender is flagged if the change is greater than the threshold.

Risks the report names

The same report lists challenges as well as benefits:

• Resources: the risk survey respondents reported as of greatest concern, followed by cyber risk, reputational risk and data quality.
• Over-reliance on tools built on historical data, which may not hold in a future crisis.
• Explainability: models whose results are hard to interpret.
• Dependence on third parties, including concentration in cloud services.
• Firms learning which signals trigger alerts and arranging their reports to avoid them.

For a lender, the last point is a reminder that the purpose of good data is to show the business as it is. Which sandbox or innovation arrangements a market offers, and what it requires, differs by market.